CVE-2020-11886

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-11886

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-11886

Published

2020-04-17T20:15:12.160Z

Modified

2026-04-11T15:27:47.771143Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

References

https://issues.opennms.org/browse/NMS-12572

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type

GIT

Repo

https://github.com/opennms/opennms

Events

Introduced

Fixed

f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1

Introduced

Fixed

d92cd6d25e402e7847b7786d4adeb5d0dc278e40

Introduced

Fixed

8cc386bbbd072ee0d2a6d0607d30797e88b812f7

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "25.2.1"
        },
        {
            "introduced": "2017"
        },
        {
            "fixed": "2017.1.21"
        },
        {
            "introduced": "2018"
        },
        {
            "fixed": "2018.1.16"
        }
    ]
}

Affected versions

meridian-foundation-2017.*

meridian-foundation-2017.1.1-1

meridian-foundation-2017.1.11-1

meridian-foundation-2017.1.12-1

meridian-foundation-2017.1.13-1

meridian-foundation-2017.1.14-1

meridian-foundation-2017.1.15-1

meridian-foundation-2017.1.16-1

meridian-foundation-2017.1.17-1

meridian-foundation-2017.1.18-1

meridian-foundation-2017.1.19-1

meridian-foundation-2017.1.20-1

meridian-foundation-2017.1.6-1

meridian-foundation-2017.1.7-1

meridian-foundation-2017.1.8-1

meridian-foundation-2017.1.9-1

meridian-foundation-2018.*

meridian-foundation-2018.1.0-1

meridian-foundation-2018.1.1-1

meridian-foundation-2018.1.10-1

meridian-foundation-2018.1.11-1

meridian-foundation-2018.1.12-1

meridian-foundation-2018.1.13-1

meridian-foundation-2018.1.14-1

meridian-foundation-2018.1.15-1

meridian-foundation-2018.1.2-1

meridian-foundation-2018.1.3-1

meridian-foundation-2018.1.4-1

meridian-foundation-2018.1.5-1

meridian-foundation-2018.1.6-1

meridian-foundation-2018.1.7-1

meridian-foundation-2018.1.8-1

meridian-foundation-2018.1.9-1

opennms-1.*

opennms-1.11.1-1

opennms-1.11.3-1

opennms-1.13.2-1

opennms-1.9.0-1

opennms-1.9.4-1

opennms-1.9.93-1

opennms-20.*

opennms-20.0.0-1

opennms-21.*

opennms-21.0.0-1

opennms-21.0.1-1

opennms-21.0.2-1

opennms-21.0.3-1

opennms-21.0.4-1

opennms-21.0.5-1

opennms-25.*

opennms-25.0.0-1

opennms-25.1.0-1

opennms-25.1.1-1

opennms-25.1.2-1

opennms-25.2.0-1

space-integration-12.*

space-integration-12.2-code-freeze

Database specific

vanir_signatures_modified

"2026-04-11T15:27:47Z"

vanir_signatures

[
    {
        "id": "CVE-2020-11886-7ba910b2",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "199311011637419260932170840270564976696",
                "288836938368943419283143853669871973966",
                "135718932720050354838971280479342424524",
                "268173271453285545032913211756943992644"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2020-11886-fc81494f",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java",
            "function": "getFrameworkUrl"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "169990158326267771928730985730669797968",
            "length": 185.0
        },
        "signature_type": "Function",
        "source": "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "2019"
            },
            {
                "fixed": "2019.1.4"
            }
        ]
    }
]