CVE-2020-11886

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-11886

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-11886

Published

2020-04-17T20:15:12Z

Modified

2026-07-08T20:30:16Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "2019"
                },
                {
                    "fixed":  "2019.1.4"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "opennms:meridian"
        }
    ]
}

References

https://issues.opennms.org/browse/NMS-12572

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type

GIT

Repo

https://github.com/opennms/opennms

Events

Introduced

Fixed

f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1

Fixed

d92cd6d25e402e7847b7786d4adeb5d0dc278e40

Fixed

8cc386bbbd072ee0d2a6d0607d30797e88b812f7

Database specific

Show details

{
    "cpe":  [
        "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "25.2.1"
        },
        {
            "introduced":  "2017"
        },
        {
            "fixed":  "2017.1.21"
        },
        {
            "introduced":  "2018"
        },
        {
            "fixed":  "2018.1.16"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

meridian-foundation-2017.*

meridian-foundation-2017.1.1-1

meridian-foundation-2017.1.11-1

meridian-foundation-2017.1.12-1

meridian-foundation-2017.1.13-1

meridian-foundation-2017.1.14-1

meridian-foundation-2017.1.15-1

meridian-foundation-2017.1.16-1

meridian-foundation-2017.1.17-1

meridian-foundation-2017.1.18-1

meridian-foundation-2017.1.19-1

meridian-foundation-2017.1.20-1

meridian-foundation-2017.1.6-1

meridian-foundation-2017.1.7-1

meridian-foundation-2017.1.8-1

meridian-foundation-2017.1.9-1

meridian-foundation-2018.*

meridian-foundation-2018.1.0-1

meridian-foundation-2018.1.1-1

meridian-foundation-2018.1.10-1

meridian-foundation-2018.1.11-1

meridian-foundation-2018.1.12-1

meridian-foundation-2018.1.13-1

meridian-foundation-2018.1.14-1

meridian-foundation-2018.1.15-1

meridian-foundation-2018.1.2-1

meridian-foundation-2018.1.3-1

meridian-foundation-2018.1.4-1

meridian-foundation-2018.1.5-1

meridian-foundation-2018.1.6-1

meridian-foundation-2018.1.7-1

meridian-foundation-2018.1.8-1

meridian-foundation-2018.1.9-1

opennms-1.*

opennms-1.11.1-1

opennms-1.11.3-1

opennms-1.13.2-1

opennms-1.9.0-1

opennms-1.9.4-1

opennms-1.9.93-1

opennms-20.*

opennms-20.0.0-1

opennms-21.*

opennms-21.0.0-1

opennms-21.0.1-1

opennms-21.0.2-1

opennms-21.0.3-1

opennms-21.0.4-1

opennms-21.0.5-1

opennms-25.*

opennms-25.0.0-1

opennms-25.1.0-1

opennms-25.1.1-1

opennms-25.1.2-1

opennms-25.2.0-1

space-integration-12.*

space-integration-12.2-code-freeze

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "199311011637419260932170840270564976696",
                "288836938368943419283143853669871973966",
                "135718932720050354838971280479342424524",
                "268173271453285545032913211756943992644"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-11886-7ba910b2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "target":  {
            "file":  "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "169990158326267771928730985730669797968",
            "length":  185
        },
        "id":  "CVE-2020-11886-fc81494f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "target":  {
            "file":  "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java",
            "function":  "getFrameworkUrl"
        }
    }
]

vanir_signatures_modified

"2026-07-08T20:30:16Z"