CVE-2021-3396

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions 2016 through 2018 before 2018.1.25 OpenNMS Meridian versions 2019 before 2019.1.16 OpenNMS Meridian versions 2020 before 2020.1.5 OpenNMS Horizon versions 1.2 through 27.0.4 OpenNMS Newts versions prior to 1.5.3

Description: The issue allows for local and remote code execution using JEXL expressions due to incorrect access control.

Recommendations: For OpenNMS Meridian versions 2016 through 2018 before 2018.1.25, update to version 2018.1.25 or later. For OpenNMS Meridian versions 2019 before 2019.1.16, update to version 2019.1.16 or later. For OpenNMS Meridian versions 2020 before 2020.1.5, update to version 2020.1.5 or later. For OpenNMS Horizon versions 1.2 through 27.0.4, update to a version later than 27.0.4. For OpenNMS Newts versions prior to 1.5.3, update to version 1.5.3 or later.