Skip to content
OpenAdvisories

Vendor

The OpenNMS Group

25 known vulnerabilities.

Products

Meridian 24 Horizon 23
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.2
    CVE-2026-89054

    OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

    A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configurati…

    The OpenNMS Group Horizon
  • High 7.1
    CVE-2023-40313

    Disable BeanShell Interpreter Remote Server Mode

    A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, …

    The OpenNMS Group Meridian Horizon org.opennms:opennms-base-assembly Maven
  • High 8.2
    CVE-2023-0872 Public exploit

    ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

    The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizo…

    The OpenNMS Group Meridian Horizon org.opennms:opennms-webapp-rest Maven
  • High 8.1
    CVE-2023-0870

    Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

    A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian …

    The OpenNMS Group Meridian Horizon org.opennms:opennms-webapp Maven