EUVD-2026-75725
GHSA-9hqx-g6f2-rj2p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the MitM or compromised-host prerequisite; C:H captures service-account file read including database credentials; I:N and A:N because the XXE path offers no write or denial-of-service capability.
Primary rating from Vendor (OpenNMS).
CVSS VectorVendor: OpenNMS
Lifecycle Timeline
2DescriptionCVE.org
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.
The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
AnalysisAI
XML External Entity injection in the OpenNMS Meridian and Horizon XML collector allows an attacker who controls a monitored endpoint's HTTP response - via a compromised host or a network man-in-the-middle position - to force the OpenNMS service to resolve external entities, exfiltrating files readable by the service account, including database credentials. Affected versions span all releases of both Meridian and Horizon prior to the fixed versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that: (1) the OpenNMS XML collector is configured and actively polling one or more HTTP or network-accessible XML data sources; and (2) the attacker either controls the response from one of those monitored endpoints (via host compromise) or occupies a network MitM position on the path between OpenNMS and the target URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) is well-calibrated: the network vector reflects that OpenNMS contacts remote monitored hosts over HTTP, but AC:H correctly captures the non-trivial precondition of attaining a MitM position or compromising a monitored endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenNMS Meridian 2024.3.13 or 2025.0.10 (for the respective Meridian release trains) or to OpenNMS Horizon 36.0.4 or newer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FIL
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple pl
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation
Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack we
Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attacke
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly i
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridi
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation
Share
External POC / Exploit Code
Leaving vuln.today