Lucene search

GitHub Advisory DatabaseGHSA-MJV2-6JV4-VRG7

HistoryFeb 23, 2023 - 3:33 p.m.

OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting

2023-02-2315:33:05

CWE-79

GitHub Advisory Database

github.com

opennms

meridian

horizon

cross-site scripting

webapp

confidential information

vulnerabilities

session access

6.7 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

30.0%

JSON

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information.

Affected configurations

Vulners

Node

org.opennms\Matchopennms

CPENameOperatorVersion
org.opennms:opennmslt31.0.4

CPE	Name	Operator	Version
	org.opennms:opennms	lt	31.0.4

References

docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13

github.com/advisories/GHSA-mjv2-6jv4-vrg7

github.com/OpenNMS/opennms/commit/9a366e6822479579e642b58058568af37658baba

github.com/OpenNMS/opennms/pull/5765

nvd.nist.gov/vuln/detail/CVE-2023-0867

6.7 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for GHSA-MJV2-6JV4-VRG7