PT-2023-16544 · Eclipse+1 · Jetty+2

Published 2023-02-23 · Updated 2023-03-07 · CVE-2023-0815

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4

Description The issue allows disclosure of usernames and passwords if the logging level is set to debug, potentially inserting sensitive information into Jetty log files. Users should be aware that OpenNMS Meridian and Horizon are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations For OpenNMS Meridian versions prior to 2023.1.0, upgrade to Meridian 2023.1.0 or newer. For OpenNMS Horizon versions prior to 31.0.4, upgrade to Horizon 31.0.4. As a temporary workaround, consider setting the logging level to a value other than debug to minimize the risk of sensitive information disclosure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-0815

GHSA-9XPJ-MVP2-3943

Affected Products

Jetty

Opennms Horizon

Opennms Meridian

References · 8

• https://github.com/OpenNMS/opennms/pull/5741/files · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9xpj-mvp2-3943 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0815 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0815 · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://github.com/OpenNMS/opennms/releases/tag/opennms-31.0.4-1 · Note
• https://t.me/cibsecurity/58790 · Telegram Post
• https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 · Note