Read the docs
TI-2023-00801 Aliases CVE-2023-0846GHSA-79jr-8fhm-8wv3

Unauthenticated, stored XSS in display of alarm reduction-key

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Fixed Meridian (The OpenNMS Group): 2023.1.0org.opennms:opennms (Maven): 31.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupMeridian—2023.1.0Patch availableCNA
—org.opennms:opennms (Maven)before 31.0.331.0.3Patch availableGHSA-79jr-8fhm-8wv3
  • Meridian VendorThe OpenNMS Group Affected — Fixed in 2023.1.0 Patch available CNA
  • org.opennms:opennms (Maven) Vendor— Affected before 31.0.3 Fixed in 31.0.3 Patch available GHSA-79jr-8fhm-8wv3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*before 31.0.4VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*before 2023.1.0VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions before 31.0.4 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions before 2023.1.0 Vulnerable ·The OpenNMS Group

Remediation

  • Fix · CNA Meridian (The OpenNMS Group) Fixed in 2023.1.0
  • Fix · GHSA-79jr-8fhm-8wv3 org.opennms:opennms (Maven) Fixed in 31.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0846
  2. 2026-10-03 Alias added: GHSA-79jr-8fhm-8wv3

References

Patch 1

Advisory 1

Other 3

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences