PT-2023-27541 · Unknown+1 · Opennms Horizon+1

Erik Wynter · Published 2023-08-23 · Updated 2023-08-30 · CVE-2023-40612

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 Meridian versions prior to 2023.1.5

Description The file editor in OpenMNS Horizon, accessible to users with ROLE FILESYSTEM EDITOR privileges, is vulnerable to XXE injection attacks. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations For OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2, upgrade to Horizon 32.0.2 or newer. For Meridian versions prior to 2023.1.5, upgrade to Meridian 2023.1.5 or newer.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2023-40612

Affected Products

Meridian

Opennms Horizon

References · 5

• https://github.com/OpenNMS/opennms/pull/6288 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-40612 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40612 · Vendor Advisory
• https://t.me/cibsecurity/69079 · Telegram Post
• https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.5 · Note