{"id":"GHSA-c3mp-9vx3-2rvv","summary":"OpenNMS Horizon RCE via JEXL2 expression","details":"OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts \u003c1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.","aliases":["CVE-2021-3396"],"modified":"2023-11-01T04:55:37.423907Z","published":"2022-05-24T17:42:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-07-11T00:13:01Z","nvd_published_at":"2021-02-17T21:15:00Z","cwe_ids":["CWE-863"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3396"},{"type":"WEB","url":"https://github.com/OpenNMS/opennms/pull/3281"},{"type":"WEB","url":"https://issues.opennms.org/browse/NMS-13103"},{"type":"WEB","url":"https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure"}],"affected":[{"package":{"name":"org.opennms:opennms","ecosystem":"Maven","purl":"pkg:maven/org.opennms/opennms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"27.0.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 27.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c3mp-9vx3-2rvv/GHSA-c3mp-9vx3-2rvv.json"}},{"package":{"name":"org.opennms.features:org.opennms.features.measurements","ecosystem":"Maven","purl":"pkg:maven/org.opennms.features/org.opennms.features.measurements"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"27.0.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 27.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c3mp-9vx3-2rvv/GHSA-c3mp-9vx3-2rvv.json"}},{"package":{"name":"org.opennms:opennms-provision","ecosystem":"Maven","purl":"pkg:maven/org.opennms/opennms-provision"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"27.0.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 27.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c3mp-9vx3-2rvv/GHSA-c3mp-9vx3-2rvv.json"}},{"package":{"name":"org.opennms:opennms-util","ecosystem":"Maven","purl":"pkg:maven/org.opennms/opennms-util"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"27.0.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 27.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c3mp-9vx3-2rvv/GHSA-c3mp-9vx3-2rvv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}