CVE-2020-12760

Publicada el 11 may 2020 · Actualizada el 04 ago 2024

Seguir esta CVE + Monitorear org.opennms.core:org.opennms.core.daemon

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 3.5%

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.

Productos afectados

n/a · n/a

Referencias

https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 https://issues.opennms.org/browse/NMS-12673 https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/