CVE-2025-53122
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-06-30
Assigner: The OpenNMS Group
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL Injection issue in OpenNMS Horizon and Meridian applications. It occurs because special elements used in SQL commands are not properly neutralized, allowing attackers to manipulate SQL queries. Specifically, the vulnerability involves the 'orderBy' clause where columns used for ordering query results cannot be safely passed as parameters in prepared statements. This allows potentially malicious input to influence the SQL query, leading to unauthorized data access or manipulation. The fix restricts the allowed columns for ordering to only legitimate ones belonging to the 'node' entity and a calculated 'severity' column, preventing arbitrary or malicious column names from being used. [1]
How can this vulnerability impact me? :
This SQL Injection vulnerability can allow an attacker with limited privileges to manipulate SQL queries within the OpenNMS Horizon or Meridian applications. This could lead to unauthorized access to sensitive data, data corruption, or other unintended database operations. Since these applications are intended for private network use and not direct Internet exposure, the risk is somewhat mitigated by network controls, but exploitation could still impact the confidentiality and integrity of organizational data. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this SQL Injection vulnerability in OpenNMS Horizon and Meridian applications, users should upgrade to Meridian 2024.2.6 or newer, or Horizon 33.16 or newer. Additionally, ensure that these applications are installed within a private network and are not directly accessible from the Internet. The fix includes restricting the allowed columns in the 'orderBy' clause to prevent injection, as implemented in the foundation-2024 branch. [1]