CVE-2023-0815

2023-02-2315:15:10

CWE-532

[email protected]

web.nvd.nist.gov

cve-2023-0815

opennms

meridian

horizon

jetty

information security

vulnerability

data breach

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.4%

JSON

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization’s private networks and should not be directly accessible
from the Internet.

Affected configurations

NVD

Node

opennmshorizonRange<31.0.4

opennmsmeridianRange<2023.1.0

CPENameOperatorVersion
opennms:horizonopennms horizonlt31.0.4
opennms:meridianopennms meridianlt2023.1.0

CPE	Name	Operator	Version
opennms:horizon	opennms horizon	lt	31.0.4
opennms:meridian	opennms meridian	lt	2023.1.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Jetty",
      "Log4j2"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "product": "Meridian",
    "programFiles": [
      "https://github.com/OpenNMS/opennms/blob/develop/opennms-base-assembly/src/main/filtered/etc/log4j2.xml"
    ],
    "programRoutines": [
      {
        "name": "log4j2.xml"
      }
    ],
    "repo": "https://github.com/OpenNMS",
    "vendor": "The OpenNMS Group ",
    "versions": [
      {
        "lessThan": "2020.1.32",
        "status": "affected",
        "version": "2020.1.0",
        "versionType": "git"
      },
      {
        "lessThan": "2021.1.24",
        "status": "affected",
        "version": "2021.1.0",
        "versionType": "git"
      },
      {
        "lessThan": "2022.1.13",
        "status": "affected",
        "version": "2022.1.0",
        "versionType": "git"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "modules": [
      "Jetty",
      "Log4j2"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "product": "Horizon",
    "programFiles": [
      "https://github.com/OpenNMS/opennms/blob/develop/opennms-base-assembly/src/main/filtered/etc/log4j2.xml"
    ],
    "programRoutines": [
      {
        "name": "log4j2.xml"
      }
    ],
    "repo": "https://github.com/OpenNMS",
    "vendor": "The OpenNMS Group",
    "versions": [
      {
        "lessThan": "31.0.4",
        "status": "affected",
        "version": "26.0.0",
        "versionType": "git"
      }
    ]
  }
]