CVE-2021-3396 json
OpenNMS Horizon RCE via JEXL2 expression
published 2021-02-17 5 y ago modified 2026-06-17 4 mo ago also GHSA-c3mp-9vx3-2rvv , EUVD-2022-3490
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
Patch / fix
- maven org.opennms:opennms 27.0.4
- maven org.opennms.features:org.opennms.features.measurements 27.0.4
- maven org.opennms:opennms-provision 27.0.4
- maven org.opennms:opennms-util 27.0.4
- opennms meridian 2018.1.25, 2019.1.16, 2020.1.5
- opennms newts 1.5.3
- github.com/OpenNMS/opennms#3281 pull request
Exploit prediction
2.37% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opennms:opennms | >=16.0.0, <27.0.4 |
27.0.4 |
| maven | org.opennms.features:org.opennms.features.measurements | >=16.0.0, <27.0.4 |
27.0.4 |
| maven | org.opennms:opennms-provision | >=16.0.0, <27.0.4 |
27.0.4 |
| maven | org.opennms:opennms-util | >=16.0.0, <27.0.4 |
27.0.4 |
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/OpenNMS/opennms/pull/3281
web
-
opennms.com
vendor-advisory
-
opennms.com
/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-3396
advisory
-
issues.opennms.org
/browse/NMS-13103
web
-
opennms.com
/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure
web
Sources
- CVE List CVE-2021-3396
- GitHub Advisory GHSA-c3mp-9vx3-2rvv
- NVD CVE-2021-3396
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.