PT-2023-27541 · Unknown+1 · Opennms Horizon+1

Erik Wynter · Publicado 2023-08-23 · Atualizado 2023-08-30 · CVE-2023-40612

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 Meridian versions prior to 2023.1.5

Description The file editor in OpenMNS Horizon, accessible to users with ROLE FILESYSTEM EDITOR privileges, is vulnerable to XXE injection attacks. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations For OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2, upgrade to Horizon 32.0.2 or newer. For Meridian versions prior to 2023.1.5, upgrade to Meridian 2023.1.5 or newer.

Correção

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

CVE-2023-40612

Produtos afetados

Meridian

Opennms Horizon

Referências · 5

• https://github.com/OpenNMS/opennms/pull/6288 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-40612 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-40612 · Aviso do Fabricante
• https://t.me/cibsecurity/69079 · Publicação no Telegram
• https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.5 · Nota