Show plain JSON{"id": "CVE-2020-11886", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2020-04-17T20:15:12.160", "references": [{"url": "https://issues.opennms.org/browse/NMS-12572", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://issues.opennms.org/browse/NMS-12572", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21."}, {"lang": "es", "value": "OpenNMS Horizon and Meridian, permite una inyecci\u00f3n HQL en el archivo element/nodeList.htm (tambi\u00e9n se conoce como NodeListController) por medio de snmpParm o snmpParmValue en la funci\u00f3n addCriteriaForSnmpParm. Esto afecta a Horizonte versiones anteriores a la versi\u00f3n 25.2.1, a Meridian versiones 2019 anteriores a 2019.1.4, Meridiano 2018 anteriores a 2018.1.16, y a Meridian versiones 2017 anteriores a 2017.1.21."}], "lastModified": "2024-11-21T04:58:49.783", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D79AB796-749E-402C-8AFD-D2EB7A757AA5", "versionEndExcluding": "25.2.1"}, {"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2461150A-54BE-4F4F-A50D-3A5A1CEDC188", "versionEndExcluding": "2017.1.21", "versionStartIncluding": "2017"}, {"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8775F899-0827-4236-B32A-D10778F1D0C6", "versionEndExcluding": "2018.1.16", "versionStartIncluding": "2018"}, {"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D96DCA0-606D-4B72-9A3B-8E2A7B57AD73", "versionEndExcluding": "2019.1.4", "versionStartIncluding": "2019"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"} 