GitHub Advisoryadvisory · Maven
GHSA-mjv2-6jv4-vrg7 OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting
MEDIUM
Official page ↗
- Aliases
- CVE-2023-0867
- Ecosystem
- Maven
- Packages
- org.opennms:opennms
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-03-03
Affected packages
• Maven org.opennms:opennms: < 31.0.4 → fixed in 31.0.4
Description
Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information.
Related
Alias · CVE (1)
- CVE-2023-0867 Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-0867 advisory
- https://github.com/OpenNMS/opennms/pull/5765 web
- https://github.com/OpenNMS/opennms/commit/9a366e6822479579e642b58058568af37658baba web
- https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 web
- https://github.com/OpenNMS/opennms package