PT-2023-16574 · Opennms · Opennms Meridian+1

Published 2023-03-22 · Updated 2023-08-16 · CVE-2023-0870

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.1 OpenNMS Horizon versions prior to 31.0.6

Description A form can be manipulated with cross-site request forgery in OpenNMS Meridian and Horizon, potentially allowing an attacker to gain access to confidential information and compromise integrity. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations For OpenNMS Meridian versions prior to 2023.1.1, upgrade to Meridian 2023.1.1 or newer. For OpenNMS Horizon versions prior to 31.0.6, upgrade to Horizon 31.0.6 or newer.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-0870

GHSA-JXR6-7QG5-8WV6

Affected Products

Opennms Horizon

Opennms Meridian

References · 8

• https://github.com/OpenNMS/opennms/pull/5835/files · Patch
• https://osv.dev/vulnerability/CVE-2023-0870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0870 · Security Note
• https://osv.dev/vulnerability/GHSA-jxr6-7qg5-8wv6 · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://twitter.com/fletch_ai/status/1692010118861185286 · Twitter Post
• https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.1 · Note
• https://t.me/cvenotify/46691 · Telegram Post