PT-2023-8929 · Opennms · Opennms Meridian+1

Stefan Schiller · Published 2023-02-22 · Updated 2023-08-16 · CVE-2023-0846

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4

Description The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to access confidential session information. This is due to inadequate protection of the web page structure. The exploitation of this issue may enable a remote attacker to gain unauthorized access to protected session information.

Recommendations For OpenNMS Meridian versions prior to 2023.1.0, upgrade to Meridian 2023.1.0 or newer. For OpenNMS Horizon versions prior to 31.0.4, upgrade to Horizon 31.0.4. As a temporary workaround, consider restricting access to the alarm reduction keys display to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02652

CVE-2023-0846

GHSA-79JR-8FHM-8WV3

Affected Products

Opennms Horizon

Opennms Meridian

References · 9

• https://github.com/OpenNMS/opennms/pull/5506/files · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-0846 · Security Note
• https://osv.dev/vulnerability/GHSA-79jr-8fhm-8wv3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0846 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02652 · Security Note
• https://github.com/OpenNMS/opennms · Note
• https://twitter.com/fletch_ai/status/1692010118861185286 · Twitter Post
• https://issues.opennms.org/browse/NMS-14877 · Note
• https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 · Note