CVE-2021-25931: CSRF
First published: Thu May 20 2021(Updated: )
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Credit: vulnerabilitylab@mend.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenNMS Horizon | >=1.0<27.1.1 | |
| OpenNMS Meridian | >=2015.1.0<2019.1.19 | |
| OpenNMS Meridian | >=2020.1.0<2020.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-25931?
The severity of CVE-2021-25931 is high with a severity value of 8.8.
How does CVE-2021-25931 affect OpenNMS Horizon?
CVE-2021-25931 affects OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1.
How does CVE-2021-25931 affect OpenNMS Meridian?
CVE-2021-25931 affects OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1.
What is the vulnerability type of CVE-2021-25931?
The vulnerability type of CVE-2021-25931 is CSRF (Cross-Site Request Forgery).
How can I fix CVE-2021-25931?
To fix CVE-2021-25931, update OpenNMS Horizon to version 27.1.1 or OpenNMS Meridian to version 2019.1.19 (for versions 2015.1.0-1 to 2019.1.18-1) or version 2020.1.7 (for versions 2020.1.0-1 to 2020.1.6-1).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/type
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/opennms
- canonical/opennms horizon
- version/opennms horizon/1.0
- canonical/opennms meridian
- version/opennms meridian/2015.1.0
- version/opennms meridian/2020.1.0