GitHub Advisoryadvisory · Maven
GHSA-9xpj-mvp2-3943 OpenNMS has potential Insertion of Sensitive Information into Log File vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2023-0815
- Ecosystem
- Maven
- Packages
- org.opennms:opennms
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-532
- Reviewed
- 2023-02-28
Affected packages
• Maven org.opennms:opennms: < 31.0.4 → fixed in 31.0.4
Description
Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug.
Related
Alias · CVE (1)
- CVE-2023-0815 Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow… vulnerability
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-0815 advisory
- https://github.com/OpenNMS/opennms/pull/5741/files web
- https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 web
- https://github.com/OpenNMS/opennms package
- https://github.com/OpenNMS/opennms/releases/tag/opennms-31.0.4-1 web