CVE-2023-0867

2023-02-2315:15:11

CWE-79

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-0867

stored xss

reflected xss

opennms meridian

horizon

web application security

session information

vulnerability

6.7 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

JSON

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization’s private networks and should not be directly accessible
from the Internet.

Affected configurations

NVD

Node

opennmshorizonRange<31.0.4

opennmsmeridianRange<2023.1.0

CPENameOperatorVersion
opennms:horizonopennms horizonlt31.0.4
opennms:meridianopennms meridianlt2023.1.0

CPE	Name	Operator	Version
opennms:horizon	opennms horizon	lt	31.0.4
opennms:meridian	opennms meridian	lt	2023.1.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Webapp"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "product": "Meridian",
    "repo": "https://github.com/OpenNMS",
    "vendor": "The OpenNMS Group",
    "versions": [
      {
        "lessThan": "2020.1.32",
        "status": "affected",
        "version": "2020.1.0",
        "versionType": "git"
      },
      {
        "lessThan": "2021.1.24",
        "status": "affected",
        "version": "2021.1.0",
        "versionType": "git"
      },
      {
        "lessThan": "2022.1.13",
        "status": "affected",
        "version": "2022.1.0",
        "versionType": "git"
      },
      {
        "status": "unaffected",
        "version": "2023.1.0"
      }
    ]
  },
  {
    "defaultStatus": "affected",
    "modules": [
      "Webapp"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "product": "Horizon",
    "repo": "https://github.com/OpenNMS",
    "vendor": "The OpenNMS Group",
    "versions": [
      {
        "lessThan": "31.0.4",
        "status": "affected",
        "version": "26.0.0",
        "versionType": "git"
      }
    ]
  }
]