What’s Vulnerable › Vulnerabilities

CVE-2020-11886

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-17 · updated 2026-06-17
• Weakness: CWE-89

Description

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

Affected products

• The OpenNMS Group Horizon: before 25.2.1 — fixed in 25.2.1
• The OpenNMS Group Meridian: from 2017 before 2017.1.21; from 2018 before 2018.1.16; from 2019 before 2019.1.4 — fixed in 2017.1.21, 2018.1.16, 2019.1.4

How to fix

Upgrade to a fixed version: The OpenNMS Group Horizon 25.2.1; The OpenNMS Group Meridian 2017.1.21, 2018.1.16, 2019.1.4. Check the vendor advisory for mitigations.

References

• https://issues.opennms.org/browse/NMS-12572
• https://issues.opennms.org/browse/NMS-12572

Get alerted when CVE-2020-11886 or the next vulnerability affects your stack