CVE-2020-11886

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-11886

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-11886

Published

2020-04-17T20:15:12.160Z

Modified

2026-07-08T20:30:16.668378Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2019"
                },
                {
                    "fixed": "2019.1.4"
                }
            ],
            "cpes": [
                "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "opennms:meridian"
        }
    ]
}

References

https://issues.opennms.org/browse/NMS-12572

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type

GIT

Repo

https://github.com/opennms/opennms

Events

Introduced

Fixed

f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1

Fixed

d92cd6d25e402e7847b7786d4adeb5d0dc278e40

Fixed

8cc386bbbd072ee0d2a6d0607d30797e88b812f7

Database specific

{
    "cpe": [
        "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "25.2.1"
        },
        {
            "introduced": "2017"
        },
        {
            "fixed": "2017.1.21"
        },
        {
            "introduced": "2018"
        },
        {
            "fixed": "2018.1.16"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

meridian-foundation-2017.*

meridian-foundation-2017.1.1-1

meridian-foundation-2017.1.11-1

meridian-foundation-2017.1.12-1

meridian-foundation-2017.1.13-1

meridian-foundation-2017.1.14-1

meridian-foundation-2017.1.15-1

meridian-foundation-2017.1.16-1

meridian-foundation-2017.1.17-1

meridian-foundation-2017.1.18-1

meridian-foundation-2017.1.19-1

meridian-foundation-2017.1.20-1

meridian-foundation-2017.1.6-1

meridian-foundation-2017.1.7-1

meridian-foundation-2017.1.8-1

meridian-foundation-2017.1.9-1

meridian-foundation-2018.*

meridian-foundation-2018.1.0-1

meridian-foundation-2018.1.1-1

meridian-foundation-2018.1.10-1

meridian-foundation-2018.1.11-1

meridian-foundation-2018.1.12-1

meridian-foundation-2018.1.13-1

meridian-foundation-2018.1.14-1

meridian-foundation-2018.1.15-1

meridian-foundation-2018.1.2-1

meridian-foundation-2018.1.3-1

meridian-foundation-2018.1.4-1

meridian-foundation-2018.1.5-1

meridian-foundation-2018.1.6-1

meridian-foundation-2018.1.7-1

meridian-foundation-2018.1.8-1

meridian-foundation-2018.1.9-1

opennms-1.*

opennms-1.11.1-1

opennms-1.11.3-1

opennms-1.13.2-1

opennms-1.9.0-1

opennms-1.9.4-1

opennms-1.9.93-1

opennms-20.*

opennms-20.0.0-1

opennms-21.*

opennms-21.0.0-1

opennms-21.0.1-1

opennms-21.0.2-1

opennms-21.0.3-1

opennms-21.0.4-1

opennms-21.0.5-1

opennms-25.*

opennms-25.0.0-1

opennms-25.1.0-1

opennms-25.1.1-1

opennms-25.1.2-1

opennms-25.2.0-1

space-integration-12.*

space-integration-12.2-code-freeze

Database specific

vanir_signatures_modified

"2026-07-08T20:30:16Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "199311011637419260932170840270564976696",
                "288836938368943419283143853669871973966",
                "135718932720050354838971280479342424524",
                "268173271453285545032913211756943992644"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "id": "CVE-2020-11886-7ba910b2",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 185.0,
            "function_hash": "169990158326267771928730985730669797968"
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/f96e10ca2c7b3234ee4bfcdc21c6b3fb053673b1",
        "id": "CVE-2020-11886-fc81494f",
        "target": {
            "function": "getFrameworkUrl",
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11886.json"