PT-2023-8929 · Opennms · Opennms Meridian+1

Stefan Schiller · Publicado 2023-02-22 · Atualizado 2023-08-16 · CVE-2023-0846

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:A/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4

Description The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to access confidential session information. This is due to inadequate protection of the web page structure. The exploitation of this issue may enable a remote attacker to gain unauthorized access to protected session information.

Recommendations For OpenNMS Meridian versions prior to 2023.1.0, upgrade to Meridian 2023.1.0 or newer. For OpenNMS Horizon versions prior to 31.0.4, upgrade to Horizon 31.0.4. As a temporary workaround, consider restricting access to the alarm reduction keys display to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2024-02652

CVE-2023-0846

GHSA-79JR-8FHM-8WV3

Produtos afetados

Opennms Horizon

Opennms Meridian

Referências · 9

• https://github.com/OpenNMS/opennms · Nota
• https://github.com/OpenNMS/opennms/pull/5506/files · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-0846 · Nota de Segurança
• https://twitter.com/fletch_ai/status/1692010118861185286 · Publicação no Twitter
• https://issues.opennms.org/browse/NMS-14877 · Nota
• https://osv.dev/vulnerability/GHSA-79jr-8fhm-8wv3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0846 · Aviso do Fabricante
• https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 · Nota
• https://bdu.fstec.ru/vul/2024-02652 · Nota de Segurança