PT-2023-27376 · Opennms · Opennms Meridian+1

Published 2023-08-17 · Updated 2024-10-08 · CVE-2023-40313

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenNMS Horizon versions prior to 32.0.2 OpenNMS Meridian versions prior to 2023.1.6 OpenNMS Meridian versions prior to 2022.1.19 OpenNMS Meridian versions prior to 2021.1.30 OpenNMS Meridian versions prior to 2020.1.38

Description A BeanShell interpreter in remote server mode could allow arbitrary remote Java code execution. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations To resolve the issue, upgrade to OpenNMS Meridian 2023.1.6 or newer. To resolve the issue, upgrade to OpenNMS Meridian 2022.1.19 or newer. To resolve the issue, upgrade to OpenNMS Meridian 2021.1.30 or newer. To resolve the issue, upgrade to OpenNMS Meridian 2020.1.38 or newer. To resolve the issue, upgrade to OpenNMS Horizon 32.0.2 or newer.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-40313

GHSA-5M5F-QG8R-P9QF

Affected Products

Opennms Horizon

Opennms Meridian

References · 12

• https://github.com/OpenNMS/opennms/pull/6368 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-40313 · Security Note
• https://osv.dev/vulnerability/GHSA-5m5f-qg8r-p9qf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40313 · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://github.com/OpenNMS/opennms/commit/2909448b039bd46241efa52c450ffdb4f5a7dee1 · Note
• https://twitter.com/CVEnew/status/1692244403258069058 · Twitter Post
• https://t.me/cvenotify/97412 · Telegram Post
• https://t.me/cibsecurity/68782 · Telegram Post
• https://docs.opennms.com/horizon/32/releasenotes/changelog.html · Note
• https://twitter.com/VulmonFeeds/status/1692276176251711669 · Twitter Post
• https://t.me/cvenotify/56806 · Telegram Post