CVE-2023-0869

Description

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridianand Horizon installation instructions state that they are intended forinstallation within an organizations private networks and should not bedirectly accessible from the Internet.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.276

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2023-0869 are affected in OpenNMS - opennms-web-api 31.0.3	Windows
Vulnerabilities CVE-2023-0869 are affected in OpenNMS - opennms-web-api for Linux 31.0.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234