CVE-2020-12760
The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.46% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- opennms/opennms horizon · opennms/opennms meridian
- Source
- cve@mitre.org
References
- https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1Release Notes
- https://issues.opennms.org/browse/NMS-12673Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/Release Notes, Vendor Advisory
- https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1Release Notes
- https://issues.opennms.org/browse/NMS-12673Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/Release Notes, Vendor Advisory
- https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.