1. Home
  2. Vulnerabilities
  3. CVE-2023-40312

CVE-2023-40312

CVSS v3.1 5.2 (Medium)
52% Progress
EPSS 0.05 % (18th)
0.05% Progress
Affected Products 2
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Graph Web & Social Timeline

Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

Weaknesses
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE Status
PUBLISHED
CNA
The OpenNMS Group
Published Date
2023-08-14 18:15:11
(13 months ago)
Updated Date
2023-08-23 16:58:38
(13 months ago)

Affected Products

Opennms

Configuration #1

    CPE23 From Up To
  Opennms Horizon from 31.0.8 version and prior 32.0.2 version cpe:2.3:a:opennms:horizon >= 31.0.8 < 32.0.2
  Opennms Meridian prior 2020.1.38 version cpe:2.3:a:opennms:meridian < 2020.1.38
  Opennms Meridian from 2022.1.0 version and prior 2022.1.19 version cpe:2.3:a:opennms:meridian >= 2022.1.0 < 2022.1.19
  Opennms Meridian from 2023.1.0 version and prior 2023.1.6 version cpe:2.3:a:opennms:meridian >= 2023.1.0 < 2023.1.6