TI-2021-07941 Aliases CVE-2021-25931 GHSA-2rq5-68hm-h4j8

Cross-site request forgery in OpenNMS

HIGH 73CWE-352Published 2021-05-20 · Updated 2025-04-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00726 54th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.opennms:opennms (Maven): 27.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	OpenNMS	opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1	—	No fix listed	CNA
—	org.opennms:opennms (Maven)	1.0.0 to before 27.1.1	27.1.1	Patch available	GHSA-2rq5-68hm-h4j8

OpenNMS Vendor— Affected opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 Fixed in — No fix listed CNA
org.opennms:opennms (Maven) Vendor— Affected 1.0.0 to before 27.1.1 Fixed in 27.1.1 Patch available GHSA-2rq5-68hm-h4j8

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	1.0 to before 27.1.1	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 1.0 to before 27.1.1 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7 Vulnerable ·The OpenNMS Group

Remediation

Fix · GHSA-2rq5-68hm-h4j8 org.opennms:opennms (Maven) Fixed in 27.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-25931
2026-10-03 Alias added: GHSA-2rq5-68hm-h4j8

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25931

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-25931

Other 1

https://github.com/OpenNMS/opennms

TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
TI-2023-21153 Disable BeanShell Interpreter Remote Server Mode CVSS 3.1HIGH 8.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences