CVE-2021-3396
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
OpenNMS Meridian versiones 2016, 2017, 2018 anteriores a 2018.1.25, versiones 2019 anteriores a 2019.1.16 y versiones 2020 anteriores a 2020.1.5, Horizon versiones 1.2 hasta 27.0.4 y Newts versiones anteriores a 1.5.3, presenta un Control de Acceso Incorrecto, que permite una ejecución de código local y remota utilizando expresiones JEXL
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-02-03 CVE Reserved
- 2021-02-17 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.opennms.com | 2022-07-12 | |
| https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure | 2022-07-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Opennms Search vendor "Opennms" | Horizon Search vendor "Opennms" for product "Horizon" | >= 16.0.0 <= 27.0.3 Search vendor "Opennms" for product "Horizon" and version " >= 16.0.0 <= 27.0.3" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Meridian Search vendor "Opennms" for product "Meridian" | >= 2016.1.0 <= 2016.1.24 Search vendor "Opennms" for product "Meridian" and version " >= 2016.1.0 <= 2016.1.24" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Meridian Search vendor "Opennms" for product "Meridian" | >= 2017.1.0 <= 2017.1.26 Search vendor "Opennms" for product "Meridian" and version " >= 2017.1.0 <= 2017.1.26" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Meridian Search vendor "Opennms" for product "Meridian" | >= 2018.1.0 < 2018.1.25 Search vendor "Opennms" for product "Meridian" and version " >= 2018.1.0 < 2018.1.25" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Meridian Search vendor "Opennms" for product "Meridian" | >= 2019.1.0 < 2019.1.16 Search vendor "Opennms" for product "Meridian" and version " >= 2019.1.0 < 2019.1.16" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Meridian Search vendor "Opennms" for product "Meridian" | >= 2020.1.0 < 2020.1.5 Search vendor "Opennms" for product "Meridian" and version " >= 2020.1.0 < 2020.1.5" | - |
Affected
| ||||||
| Opennms Search vendor "Opennms" | Newts Search vendor "Opennms" for product "Newts" | < 1.5.3 Search vendor "Opennms" for product "Newts" and version " < 1.5.3" | - |
Affected
| ||||||