PT-2023-16571 · Opennms · Opennms Meridian+1

Baharuddin Zulkifli · Publicado 2023-02-23 · Atualizado 2023-03-03 · CVE-2023-0867

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4

Description Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages could allow an attacker access to confidential session information.

Recommendations For OpenNMS Meridian versions prior to 2023.1.0, upgrade to Meridian 2023.1.0 or newer. For OpenNMS Horizon versions prior to 31.0.4, upgrade to Horizon 31.0.4. As a temporary workaround, consider restricting access to the webapp jsp pages until a patch is available.

Correção

RCE

XSS

Enumeração de Fraquezas

CWE-20

CWE-79

Identificadores relacionados

CVE-2023-0867

GHSA-MJV2-6JV4-VRG7

Produtos afetados

Opennms Horizon

Opennms Meridian

Referências · 8

• https://github.com/OpenNMS/opennms · Nota
• https://github.com/OpenNMS/opennms/commit/9a366e6822479579e642b58058568af37658baba · Nota
• https://github.com/OpenNMS/opennms/pull/5765 · Correção
• https://osv.dev/vulnerability/CVE-2023-0867 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0867 · Nota de Segurança
• https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 · Nota
• https://t.me/cibsecurity/58788 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-mjv2-6jv4-vrg7 · Aviso do Fabricante