PT-2023-27375 · Opennms · Meridian+1
Fooker
·
Published
2023-08-14
·
Updated
2023-08-23
·
CVE-2023-40312
CVSS v3.1
6.7
Medium
| Vector | AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenMNS Horizon versions 31.0.8 through 32.0.2
Meridian versions prior to 2023.1.6
Meridian versions prior to 2022.1.19
Meridian versions prior to 2021.1.30
Meridian versions prior to 2020.1.38
Description
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon on multiple platforms, allowing an attacker to craft a malicious XSS payload. The solution is to upgrade to a newer version. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
Recommendations
To resolve the issue, upgrade to Meridian 2023.1.6 or newer.
To resolve the issue, upgrade to Meridian 2022.1.19 or newer.
To resolve the issue, upgrade to Meridian 2021.1.30 or newer.
To resolve the issue, upgrade to Meridian 2020.1.38 or newer.
To resolve the issue, upgrade to Horizon 32.0.2 or newer.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Meridian
Opennms Horizon