PT-2023-27375 · Opennms · Meridian+1
Fooker
·
Publicado
2023-08-14
·
Atualizado
2023-08-23
·
CVE-2023-40312
CVSS v3.1
6.7
Média
| Vetor | AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenMNS Horizon versions 31.0.8 through 32.0.2
Meridian versions prior to 2023.1.6
Meridian versions prior to 2022.1.19
Meridian versions prior to 2021.1.30
Meridian versions prior to 2020.1.38
Description
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon on multiple platforms, allowing an attacker to craft a malicious XSS payload. The solution is to upgrade to a newer version. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
Recommendations
To resolve the issue, upgrade to Meridian 2023.1.6 or newer.
To resolve the issue, upgrade to Meridian 2022.1.19 or newer.
To resolve the issue, upgrade to Meridian 2021.1.30 or newer.
To resolve the issue, upgrade to Meridian 2020.1.38 or newer.
To resolve the issue, upgrade to Horizon 32.0.2 or newer.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Meridian
Opennms Horizon