PT-2023-16572 · Opennms · Opennms Meridian+1

Published 2023-02-23 · Updated 2023-03-07 · CVE-2023-0868

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4

Description Reflected cross-site scripting in graph results could allow an attacker to steal session cookies. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations For OpenNMS Meridian versions prior to 2023.1.0, upgrade to Meridian 2023.1.0 or newer. For OpenNMS Horizon versions prior to 31.0.4, upgrade to Horizon 31.0.4. As a temporary workaround, consider restricting access to the graph results feature until a patch is available.

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2023-0868

GHSA-G57G-RVPG-2F2C

Affected Products

Opennms Horizon

Opennms Meridian

References · 8

• https://github.com/OpenNMS/opennms/pull/5740 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0868 · Security Note
• https://osv.dev/vulnerability/GHSA-g57g-rvpg-2f2c · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://github.com/OpenNMS/opennms/commit/a47e193f820c222b309763b508009e54b2f0e7f5 · Note
• https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 · Note
• https://t.me/cibsecurity/58781 · Telegram Post