{"answers":{"affected":"8 open source packages ship an affected version, including org.opennms.features:org.opennms.features.measurements, org.opennms:opennms and org.opennms:opennms-provision. It affects 3 products.","exploited":"There is no known exploitation of CVE-2021-3396 in the wild and no public exploit code.","fix":"Upgrade org.opennms.features:org.opennms.features.measurements to 27.0.4 or later.","what":"CVE-2021-3396 is a high-severity code injection vulnerability in n/a, published on 17 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-3396 and fix it if it is affected.\n\nWhat it is: CVE-2021-3396 is a high-severity code injection vulnerability in n/a, published on 17 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-3396 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.opennms.features:org.opennms.features.measurements (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms.features:org.opennms.features.measurements (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms-provision (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms-provision (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms-util (Maven): affected from 16.0.0; fixed in 27.0.4\n- org.opennms:opennms-util (Maven): affected from 16.0.0; fixed in 27.0.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-3396/ (Markdown: https://insights.sbomify.com/CVE-2021-3396/index.md)","id":"CVE-2021-3396","markdown":"https://insights.sbomify.com/CVE-2021-3396/index.md","name":"CVE-2021-3396","record":{"aliases":["GHSA-c3mp-9vx3-2rvv"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Network monitoring software","requires_auth":"low_privilege","summary":"Attackers can execute arbitrary code via JEXL expressions due to incorrect access control in OpenNMS Meridian and Horizon.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"horizon","vendor":"opennms"},{"product":"meridian","vendor":"opennms"},{"product":"newts","vendor":"opennms"}],"cvss":{"score":8.8,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts \u003c1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"OpenNMS Horizon RCE via JEXL2 expression","id":"CVE-2021-3396","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"code_injection","year":"2021"},"n_packages":8,"n_references":2,"next":{"headline":"Integer overflow in n/a","id":"CVE-2021-3398"},"packages":[{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms.features:org.opennms.features.measurements","purl":null,"source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms.features:org.opennms.features.measurements","purl":"pkg:maven/org.opennms.features/org.opennms.features.measurements","source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms","purl":null,"source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms","purl":"pkg:maven/org.opennms/opennms","source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms-provision","purl":null,"source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms-provision","purl":"pkg:maven/org.opennms/opennms-provision","source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms-util","purl":null,"source":"GHSA-c3mp-9vx3-2rvv"},{"ecosystem":"Maven","fixed":["27.0.4"],"introduced":["16.0.0"],"last_affected":[],"package":"org.opennms:opennms-util","purl":"pkg:maven/org.opennms/opennms-util","source":"GHSA-c3mp-9vx3-2rvv"}],"prev":{"headline":"Cross-site scripting in n/a","id":"CVE-2021-3395"},"products":["n/a"],"published":"2021-02-17","related":[{"cvss_score":8.8,"headline":"Cross-Site Request Forgery in OpenNMS Horizon","id":"CVE-2021-25931","kev_date_added":null,"published":"2021-05-20"},{"cvss_score":8.2,"headline":"ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users","id":"CVE-2023-0872","kev_date_added":null,"published":"2023-08-14"},{"cvss_score":8.1,"headline":"Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)","id":"CVE-2023-0870","kev_date_added":null,"published":"2023-03-22"},{"cvss_score":8.1,"headline":"SQL injection in n/a","id":"CVE-2020-11886","kev_date_added":null,"published":"2020-04-17"},{"cvss_score":7.1,"headline":"Disable BeanShell Interpreter Remote Server Mode","id":"CVE-2023-40313","kev_date_added":null,"published":"2023-08-17"},{"cvss_score":6.8,"headline":"Plaintext Password Present in the Web logs","id":"CVE-2023-0815","kev_date_added":null,"published":"2023-02-23"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["n/a"]},"summary":"Attackers can execute arbitrary code via JEXL expressions due to incorrect access control in OpenNMS Meridian and Horizon.","url":"https://insights.sbomify.com/CVE-2021-3396/"}