High severityNVD Advisory· Published May 11, 2020· Updated Aug 4, 2024
CVE-2020-12760
CVE-2020-12760
Description
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.opennms.core:org.opennms.core.daemonMaven | < 26.0.1 | 26.0.1 |
Affected products
2- OpenNMS/OpenNMS Horizondescription
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-853f-x27w-8r74ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-12760ghsaADVISORY
- github.com/OpenNMS/opennms/commit/e21fc14ce355533493da0db815bd81a66e291382ghsaWEB
- github.com/OpenNMS/opennms/pull/2983ghsaWEB
- github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1ghsax_refsource_MISCWEB
- issues.opennms.org/browse/NMS-12673ghsax_refsource_MISCWEB
- www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-releasedghsaWEB
- www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/mitrex_refsource_MISC
- www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-releasedghsaWEB
- www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/mitrex_refsource_MISC
- www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-releasedghsaWEB
- www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.