CVE-2021-25931: CSRF

Published May 20, 2021
·
Updated

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at /opennms/admin/userGroupView/users/updateUser. This flaw allows assigning ROLEADMIN security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.

Other sources

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at /opennms/admin/userGroupView/users/updateUser. This flaw allows assigning ROLEADMIN security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.

— GitHub

Affected Software

4 affected componentsFixes available
OpenNMS Horizon>=1.0<27.1.1
OpenNMS Meridian>=2015.1.0<2019.1.19
OpenNMS Meridian>=2020.1.0<2020.1.7
maven/org.opennms:opennms>=1.0.0<27.1.1
27.1.1

Remediation

Patch Available

https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84

Patch Available

https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c

Event History

May 20, 2021
CVE Published
via MITRE·02:54 PM
Data Sourced
via MITRE·02:54 PM
DescriptionWeakness
May 25, 2021
Advisory Published
via GitHub·06:46 PM
Data Sourced
via GitHub·06:46 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-25931?

The severity of CVE-2021-25931 is high with a severity value of 8.8.

2

How does CVE-2021-25931 affect OpenNMS Horizon?

CVE-2021-25931 affects OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1.

3

How does CVE-2021-25931 affect OpenNMS Meridian?

CVE-2021-25931 affects OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1.

4

What is the vulnerability type of CVE-2021-25931?

The vulnerability type of CVE-2021-25931 is CSRF (Cross-Site Request Forgery).

5

How can I fix CVE-2021-25931?

To fix CVE-2021-25931, update OpenNMS Horizon to version 27.1.1 or OpenNMS Meridian to version 2019.1.19 (for versions 2015.1.0-1 to 2019.1.18-1) or version 2020.1.7 (for versions 2020.1.0-1 to 2020.1.6-1).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2021-25931 - CSRF - SecAlerts