Read the docs
TI-2021-07940 Aliases CVE-2021-25930GHSA-p63h-7hw8-5cw4

Cross-site request forgery in OpenNMS

Priority MEDIUM 53CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00633 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.opennms:opennms (Maven): 27.1.1org.opennms:opennms-config (Maven): 27.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OpenNMSopennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1—No fix listedCNA
—org.opennms:opennms (Maven)1.0.0 to before 27.1.127.1.1Patch availableGHSA-p63h-7hw8-5cw4
—org.opennms:opennms-config (Maven)1.0.0 to before 27.1.127.1.1Patch availableGHSA-p63h-7hw8-5cw4
  • OpenNMS Vendor— Affected opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 Fixed in — No fix listed CNA
  • org.opennms:opennms (Maven) Vendor— Affected 1.0.0 to before 27.1.1 Fixed in 27.1.1 Patch available GHSA-p63h-7hw8-5cw4
  • org.opennms:opennms-config (Maven) Vendor— Affected 1.0.0 to before 27.1.1 Fixed in 27.1.1 Patch available GHSA-p63h-7hw8-5cw4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*1.0 to before 27.1.1VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 1.0 to before 27.1.1 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7 Vulnerable ·The OpenNMS Group

Remediation

  • Fix · GHSA-p63h-7hw8-5cw4 org.opennms:opennms (Maven) Fixed in 27.1.1 Advisory →
  • Fix · GHSA-p63h-7hw8-5cw4 org.opennms:opennms-config (Maven) Fixed in 27.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25930
  2. 2026-10-03 Alias added: GHSA-p63h-7hw8-5cw4
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
  • TI-2023-21153 Disable BeanShell Interpreter Remote Server Mode CVSS 3.1HIGH 8.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences