CVE-2021-25930

2021-05-2014:15:07

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.6%

JSON

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

CPENameOperatorVersion
opennmseqopennms-15.0.2-1
opennmseqopennms-20.1.0-1
opennmseqmeridian-foundation-2017.1.0-1
opennmseqopennms-1.10.6-1
opennmseqopennms-14.0.0-1
opennmseqopennms-20.0.0-1
opennmseqopennms-1.10.2-1
opennmseqopennms-1.10.13-1
opennmseqopennms-19.1.0-1
opennmseqopennms-20.0.2-1

Name	Operator	Version
opennms	eq	opennms-15.0.2-1
opennms	eq	opennms-20.1.0-1
opennms	eq	meridian-foundation-2017.1.0-1
opennms	eq	opennms-1.10.6-1
opennms	eq	opennms-14.0.0-1
opennms	eq	opennms-20.0.0-1
opennms	eq	opennms-1.10.2-1
opennms	eq	opennms-1.10.13-1
opennms	eq	opennms-19.1.0-1
opennms	eq	opennms-20.0.2-1