Cross-Site Request Forgery in OpenNMS Horizon

中 4.3CVE-2021-25930 · GHSA-p63h-7hw8-5cw4 · 20/05/2021 公開 · 17/06/2026 更新

要点

CVE-2021-25930 は org.opennms:opennms, org.opennms:opennms-config, horizon (opennms) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.4% より高い）。
対処：27.1.1, 2019.1.19, 2020.1.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.opennms:opennms Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
org.opennms:opennms-config Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
horizon opennms	`≥ 1.0, < 27.1.1`	`27.1.1`
meridian opennms	`≥ 2015.1.0, < 2019.1.19≥ 2020.1.0, < 2020.1.7`	`2019.1.192020.1.7`

概要

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

NVD の説明

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.