CVEvulnerability
CVE-2020-12760
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-05-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
Affected configurations
• opennms opennms horizon (< 26.1.0)
• opennms opennms meridian (< 2018.1.19)
• opennms opennms meridian (>= 2019 < 2019.1.7)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 Release Notes
- https://issues.opennms.org/browse/NMS-12673 Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/ Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/ Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/ Release Notes, Vendor Advisory
- https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 Release Notes
- https://issues.opennms.org/browse/NMS-12673 Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/ Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/ Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/ Release Notes, Vendor Advisory