Cross-Site Request Forgery in OpenNMS Horizon

TRUNG BÌNH 4.3CVE-2021-25930 · GHSA-p63h-7hw8-5cw4 · Công bố 20/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-25930 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng org.opennms:opennms, org.opennms:opennms-config, horizon (opennms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.63%, cao hơn 50.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 27.1.1, 2019.1.19, 2020.1.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.opennms:opennms Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
org.opennms:opennms-config Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
horizon opennms	`≥ 1.0, < 27.1.1`	`27.1.1`
meridian opennms	`≥ 2015.1.0, < 2019.1.19≥ 2020.1.0, < 2020.1.7`	`2019.1.192020.1.7`

Mô tả

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

Mô tả của NVD

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.