CVE-2021-25930

🗓️ 20 May 2021 14:15:07Reported by [email protected]Type

OpenNMS Horizon and Meridian versions opennms-1-0-stable through opennms-27.1.0-1 and meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1, and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 allow CSRF attack due to lack of CSRF protection and user name validation while renaming, leading to privilege escalation and user deletio

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2021-25930	30 Apr 202521:15	–	circl
CNNVD	Opennms Group: OpenNMS Cross-site Request Forgery Vulnerability	20 May 202100:00	–	cnnvd
CVE	CVE-2021-25930	20 May 202113:57	–	cve
Cvelist	CVE-2021-25930	20 May 202113:57	–	cvelist
EUVD	EUVD-2021-1144	7 Oct 202500:30	–	euvd
Github Security Blog	Cross-Site Request Forgery in OpenNMS Horizon	25 May 202118:46	–	github
Mend	CVE-2021-25930	20 May 202113:57	–	mend
osv_cve	CVE-2021-25930	20 May 202114:15	–	osv_cve
osv_ghsa	GHSA-P63H-7HW8-5CW4 Cross-Site Request Forgery in OpenNMS Horizon	25 May 202118:46	–	osv_ghsa
Prion	Cross site request forgery (csrf)	20 May 202114:15	–	prion

NVD

Node

opennms horizonRange1.0–27.1.1

opennms meridianRange2015.1.0–2019.1.19

opennms meridianRange2020.1.0–2020.1.7

Source	Link
github	www.github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
whitesourcesoftware	www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25930
github	www.github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84

17 Jun 2026 03:42Current

CVSS 3.14.3

CVSS 24.3

EPSS0.00633

SSVC

CWE-352