Vulnerability Details CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.025
EPSS Ranking 84.5%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
Products affected by CVE-2021-3396
-
cpe:2.3:a:opennms:horizon:16.0.0
-
cpe:2.3:a:opennms:horizon:17.0.0
-
cpe:2.3:a:opennms:horizon:17.1.0
-
cpe:2.3:a:opennms:horizon:17.1.1
-
cpe:2.3:a:opennms:horizon:18.0.0
-
cpe:2.3:a:opennms:horizon:18.0.1
-
cpe:2.3:a:opennms:horizon:18.0.2
-
cpe:2.3:a:opennms:horizon:18.0.3
-
cpe:2.3:a:opennms:horizon:18.0.4
-
cpe:2.3:a:opennms:horizon:19.0.0
-
cpe:2.3:a:opennms:horizon:19.0.1
-
cpe:2.3:a:opennms:horizon:19.1.0
-
cpe:2.3:a:opennms:horizon:20.0.0
-
cpe:2.3:a:opennms:horizon:20.0.1
-
cpe:2.3:a:opennms:horizon:20.0.2
-
cpe:2.3:a:opennms:horizon:20.1.0
-
cpe:2.3:a:opennms:horizon:21.0.0
-
cpe:2.3:a:opennms:horizon:21.0.1
-
cpe:2.3:a:opennms:horizon:21.0.2
-
cpe:2.3:a:opennms:horizon:21.0.3
-
cpe:2.3:a:opennms:horizon:21.0.4
-
cpe:2.3:a:opennms:horizon:21.0.5
-
cpe:2.3:a:opennms:horizon:21.1.0
-
cpe:2.3:a:opennms:horizon:22.0.0
-
cpe:2.3:a:opennms:horizon:22.0.1
-
cpe:2.3:a:opennms:horizon:22.0.2
-
cpe:2.3:a:opennms:horizon:22.0.3
-
cpe:2.3:a:opennms:horizon:22.0.4
-
cpe:2.3:a:opennms:horizon:23.0.0
-
cpe:2.3:a:opennms:horizon:23.0.1
-
cpe:2.3:a:opennms:horizon:23.0.2
-
cpe:2.3:a:opennms:horizon:23.0.3
-
cpe:2.3:a:opennms:horizon:23.0.4
-
cpe:2.3:a:opennms:horizon:24.0.0
-
cpe:2.3:a:opennms:horizon:24.1.0
-
cpe:2.3:a:opennms:horizon:24.1.1
-
cpe:2.3:a:opennms:horizon:24.1.2
-
cpe:2.3:a:opennms:horizon:24.1.3
-
cpe:2.3:a:opennms:horizon:25.0.0
-
cpe:2.3:a:opennms:horizon:25.1.0
-
cpe:2.3:a:opennms:horizon:25.1.1
-
cpe:2.3:a:opennms:horizon:25.1.2
-
cpe:2.3:a:opennms:horizon:25.2.0
-
cpe:2.3:a:opennms:horizon:25.2.1
-
cpe:2.3:a:opennms:horizon:26.0.0
-
cpe:2.3:a:opennms:horizon:26.0.1
-
cpe:2.3:a:opennms:horizon:26.1.0
-
cpe:2.3:a:opennms:horizon:26.1.1
-
cpe:2.3:a:opennms:horizon:26.1.2
-
cpe:2.3:a:opennms:horizon:26.1.3
-
cpe:2.3:a:opennms:horizon:26.2.0
-
cpe:2.3:a:opennms:horizon:26.2.1
-
cpe:2.3:a:opennms:horizon:26.2.2
-
cpe:2.3:a:opennms:horizon:27.0.0
-
cpe:2.3:a:opennms:horizon:27.0.1
-
cpe:2.3:a:opennms:horizon:27.0.2
-
cpe:2.3:a:opennms:horizon:27.0.3
-
cpe:2.3:a:opennms:meridian:2016.1.0
-
cpe:2.3:a:opennms:meridian:2016.1.1-1
-
cpe:2.3:a:opennms:meridian:2016.1.10-1
-
cpe:2.3:a:opennms:meridian:2016.1.11-1
-
cpe:2.3:a:opennms:meridian:2016.1.12-1
-
cpe:2.3:a:opennms:meridian:2016.1.13-1
-
cpe:2.3:a:opennms:meridian:2016.1.14-1
-
cpe:2.3:a:opennms:meridian:2016.1.15-1
-
cpe:2.3:a:opennms:meridian:2016.1.16-1
-
cpe:2.3:a:opennms:meridian:2016.1.17-1
-
cpe:2.3:a:opennms:meridian:2016.1.18-1
-
cpe:2.3:a:opennms:meridian:2016.1.19-1
-
cpe:2.3:a:opennms:meridian:2016.1.2-1
-
cpe:2.3:a:opennms:meridian:2016.1.20
-
cpe:2.3:a:opennms:meridian:2016.1.20-1
-
cpe:2.3:a:opennms:meridian:2016.1.21
-
cpe:2.3:a:opennms:meridian:2016.1.21-1
-
cpe:2.3:a:opennms:meridian:2016.1.22
-
cpe:2.3:a:opennms:meridian:2016.1.22-1
-
cpe:2.3:a:opennms:meridian:2016.1.23
-
cpe:2.3:a:opennms:meridian:2016.1.23-1
-
cpe:2.3:a:opennms:meridian:2016.1.24
-
cpe:2.3:a:opennms:meridian:2016.1.3-1
-
cpe:2.3:a:opennms:meridian:2016.1.4-1
-
cpe:2.3:a:opennms:meridian:2016.1.5-1
-
cpe:2.3:a:opennms:meridian:2016.1.6-1
-
cpe:2.3:a:opennms:meridian:2016.1.7-1
-
cpe:2.3:a:opennms:meridian:2016.1.8-1
-
cpe:2.3:a:opennms:meridian:2016.1.9-1
-
cpe:2.3:a:opennms:meridian:2017.1.0
-
cpe:2.3:a:opennms:meridian:2017.1.0-1
-
cpe:2.3:a:opennms:meridian:2017.1.1
-
cpe:2.3:a:opennms:meridian:2017.1.1-1
-
cpe:2.3:a:opennms:meridian:2017.1.10
-
cpe:2.3:a:opennms:meridian:2017.1.10-1
-
cpe:2.3:a:opennms:meridian:2017.1.11
-
cpe:2.3:a:opennms:meridian:2017.1.11-1
-
cpe:2.3:a:opennms:meridian:2017.1.12
-
cpe:2.3:a:opennms:meridian:2017.1.12-1
-
cpe:2.3:a:opennms:meridian:2017.1.13
-
cpe:2.3:a:opennms:meridian:2017.1.13-1
-
cpe:2.3:a:opennms:meridian:2017.1.14
-
cpe:2.3:a:opennms:meridian:2017.1.14-1
-
cpe:2.3:a:opennms:meridian:2017.1.15
-
cpe:2.3:a:opennms:meridian:2017.1.15-1
-
cpe:2.3:a:opennms:meridian:2017.1.16
-
cpe:2.3:a:opennms:meridian:2017.1.16-1
-
cpe:2.3:a:opennms:meridian:2017.1.17
-
cpe:2.3:a:opennms:meridian:2017.1.17-1
-
cpe:2.3:a:opennms:meridian:2017.1.18
-
cpe:2.3:a:opennms:meridian:2017.1.18-1
-
cpe:2.3:a:opennms:meridian:2017.1.19
-
cpe:2.3:a:opennms:meridian:2017.1.19-1
-
cpe:2.3:a:opennms:meridian:2017.1.2
-
cpe:2.3:a:opennms:meridian:2017.1.2-1
-
cpe:2.3:a:opennms:meridian:2017.1.20
-
cpe:2.3:a:opennms:meridian:2017.1.20-1
-
cpe:2.3:a:opennms:meridian:2017.1.21
-
cpe:2.3:a:opennms:meridian:2017.1.21-1
-
cpe:2.3:a:opennms:meridian:2017.1.22
-
cpe:2.3:a:opennms:meridian:2017.1.22-1
-
cpe:2.3:a:opennms:meridian:2017.1.23
-
cpe:2.3:a:opennms:meridian:2017.1.23-1
-
cpe:2.3:a:opennms:meridian:2017.1.24
-
cpe:2.3:a:opennms:meridian:2017.1.24-1
-
cpe:2.3:a:opennms:meridian:2017.1.25
-
cpe:2.3:a:opennms:meridian:2017.1.25-1
-
cpe:2.3:a:opennms:meridian:2017.1.26
-
cpe:2.3:a:opennms:meridian:2017.1.3
-
cpe:2.3:a:opennms:meridian:2017.1.3-1
-
cpe:2.3:a:opennms:meridian:2017.1.4
-
cpe:2.3:a:opennms:meridian:2017.1.4-1
-
cpe:2.3:a:opennms:meridian:2017.1.5
-
cpe:2.3:a:opennms:meridian:2017.1.5-1
-
cpe:2.3:a:opennms:meridian:2017.1.6
-
cpe:2.3:a:opennms:meridian:2017.1.6-1
-
cpe:2.3:a:opennms:meridian:2017.1.7
-
cpe:2.3:a:opennms:meridian:2017.1.7-1
-
cpe:2.3:a:opennms:meridian:2017.1.8
-
cpe:2.3:a:opennms:meridian:2017.1.8-1
-
cpe:2.3:a:opennms:meridian:2017.1.9
-
cpe:2.3:a:opennms:meridian:2017.1.9-1
-
cpe:2.3:a:opennms:meridian:2018.1.0
-
cpe:2.3:a:opennms:meridian:2018.1.0-1
-
cpe:2.3:a:opennms:meridian:2018.1.1
-
cpe:2.3:a:opennms:meridian:2018.1.1-1
-
cpe:2.3:a:opennms:meridian:2018.1.10
-
cpe:2.3:a:opennms:meridian:2018.1.10-1
-
cpe:2.3:a:opennms:meridian:2018.1.11
-
cpe:2.3:a:opennms:meridian:2018.1.11-1
-
cpe:2.3:a:opennms:meridian:2018.1.12
-
cpe:2.3:a:opennms:meridian:2018.1.12-1
-
cpe:2.3:a:opennms:meridian:2018.1.13
-
cpe:2.3:a:opennms:meridian:2018.1.13-1
-
cpe:2.3:a:opennms:meridian:2018.1.14
-
cpe:2.3:a:opennms:meridian:2018.1.14-1
-
cpe:2.3:a:opennms:meridian:2018.1.15
-
cpe:2.3:a:opennms:meridian:2018.1.15-1
-
cpe:2.3:a:opennms:meridian:2018.1.16
-
cpe:2.3:a:opennms:meridian:2018.1.16-1
-
cpe:2.3:a:opennms:meridian:2018.1.17
-
cpe:2.3:a:opennms:meridian:2018.1.17-1
-
cpe:2.3:a:opennms:meridian:2018.1.18
-
cpe:2.3:a:opennms:meridian:2018.1.18-1
-
cpe:2.3:a:opennms:meridian:2018.1.19
-
cpe:2.3:a:opennms:meridian:2018.1.19-1
-
cpe:2.3:a:opennms:meridian:2018.1.2
-
cpe:2.3:a:opennms:meridian:2018.1.2-1
-
cpe:2.3:a:opennms:meridian:2018.1.20
-
cpe:2.3:a:opennms:meridian:2018.1.20-1
-
cpe:2.3:a:opennms:meridian:2018.1.21
-
cpe:2.3:a:opennms:meridian:2018.1.21-1
-
cpe:2.3:a:opennms:meridian:2018.1.22
-
cpe:2.3:a:opennms:meridian:2018.1.22-1
-
cpe:2.3:a:opennms:meridian:2018.1.23
-
cpe:2.3:a:opennms:meridian:2018.1.23-1
-
cpe:2.3:a:opennms:meridian:2018.1.24
-
cpe:2.3:a:opennms:meridian:2018.1.24-1
-
cpe:2.3:a:opennms:meridian:2018.1.3
-
cpe:2.3:a:opennms:meridian:2018.1.3-1
-
cpe:2.3:a:opennms:meridian:2018.1.4
-
cpe:2.3:a:opennms:meridian:2018.1.4-1
-
cpe:2.3:a:opennms:meridian:2018.1.5
-
cpe:2.3:a:opennms:meridian:2018.1.5-1
-
cpe:2.3:a:opennms:meridian:2018.1.6
-
cpe:2.3:a:opennms:meridian:2018.1.6-1
-
cpe:2.3:a:opennms:meridian:2018.1.7
-
cpe:2.3:a:opennms:meridian:2018.1.7-1
-
cpe:2.3:a:opennms:meridian:2018.1.8
-
cpe:2.3:a:opennms:meridian:2018.1.8-1
-
cpe:2.3:a:opennms:meridian:2018.1.9
-
cpe:2.3:a:opennms:meridian:2018.1.9-1
-
cpe:2.3:a:opennms:meridian:2019.1.0
-
cpe:2.3:a:opennms:meridian:2019.1.0-1
-
cpe:2.3:a:opennms:meridian:2019.1.1
-
cpe:2.3:a:opennms:meridian:2019.1.1-1
-
cpe:2.3:a:opennms:meridian:2019.1.10
-
cpe:2.3:a:opennms:meridian:2019.1.10-1
-
cpe:2.3:a:opennms:meridian:2019.1.11
-
cpe:2.3:a:opennms:meridian:2019.1.11-1
-
cpe:2.3:a:opennms:meridian:2019.1.12
-
cpe:2.3:a:opennms:meridian:2019.1.12-1
-
cpe:2.3:a:opennms:meridian:2019.1.13
-
cpe:2.3:a:opennms:meridian:2019.1.13-1
-
cpe:2.3:a:opennms:meridian:2019.1.14
-
cpe:2.3:a:opennms:meridian:2019.1.14-1
-
cpe:2.3:a:opennms:meridian:2019.1.15
-
cpe:2.3:a:opennms:meridian:2019.1.15-1
-
cpe:2.3:a:opennms:meridian:2019.1.2
-
cpe:2.3:a:opennms:meridian:2019.1.2-1
-
cpe:2.3:a:opennms:meridian:2019.1.3
-
cpe:2.3:a:opennms:meridian:2019.1.3-1
-
cpe:2.3:a:opennms:meridian:2019.1.4
-
cpe:2.3:a:opennms:meridian:2019.1.4-1
-
cpe:2.3:a:opennms:meridian:2019.1.5
-
cpe:2.3:a:opennms:meridian:2019.1.5-1
-
cpe:2.3:a:opennms:meridian:2019.1.6
-
cpe:2.3:a:opennms:meridian:2019.1.6-1
-
cpe:2.3:a:opennms:meridian:2019.1.7
-
cpe:2.3:a:opennms:meridian:2019.1.7-1
-
cpe:2.3:a:opennms:meridian:2019.1.8
-
cpe:2.3:a:opennms:meridian:2019.1.8-1
-
cpe:2.3:a:opennms:meridian:2019.1.9
-
cpe:2.3:a:opennms:meridian:2020.1.0
-
cpe:2.3:a:opennms:meridian:2020.1.1
-
cpe:2.3:a:opennms:meridian:2020.1.1-1
-
cpe:2.3:a:opennms:meridian:2020.1.2
-
cpe:2.3:a:opennms:meridian:2020.1.2-1
-
cpe:2.3:a:opennms:meridian:2020.1.3
-
cpe:2.3:a:opennms:meridian:2020.1.3-1
-
cpe:2.3:a:opennms:meridian:2020.1.4
-
cpe:2.3:a:opennms:meridian:2020.1.4-1
-
cpe:2.3:a:opennms:newts:-