CVE-2020-11886: Opennms Horizon

High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days.

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

Affected products

• Opennms Horizon: before 25.2.1 (fixed in 25.2.1)
• Opennms Meridian: from 2017, before 2017.1.21 (fixed in 2017.1.21); from 2018, before 2018.1.16 (fixed in 2018.1.16); from 2019, before 2019.1.4 (fixed in 2019.1.4)

Published 2020-04-17. Last modified 2026-06-17.