TI-2023-00822 Aliases CVE-2023-0867 GHSA-mjv2-6jv4-vrg7

Multiple stored and reflected Cross-site Scripting in webapp

LOW 30CWE-20Published 2023-02-23 · Updated 2024-08-02

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

EPSS 0.00424 36th percentileScored 2026-11-07

Fix Fixed Meridian (The OpenNMS Group): 2023.1.0org.opennms:opennms (Maven): 31.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The OpenNMS Group	Meridian	—	2023.1.0	Patch available	CNA
—	org.opennms:opennms (Maven)	before 31.0.4	31.0.4	Patch available	GHSA-mjv2-6jv4-vrg7

Meridian VendorThe OpenNMS Group Affected — Fixed in 2023.1.0 Patch available CNA
org.opennms:opennms (Maven) Vendor— Affected before 31.0.4 Fixed in 31.0.4 Patch available GHSA-mjv2-6jv4-vrg7

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	before 31.0.4	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	before 2023.1.0	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions before 31.0.4 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions before 2023.1.0 Vulnerable ·The OpenNMS Group

Remediation

Fix · CNA Meridian (The OpenNMS Group) Fixed in 2023.1.0
Fix · GHSA-mjv2-6jv4-vrg7 org.opennms:opennms (Maven) Fixed in 31.0.4 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-23
The OpenNMS Group Horizon 31.0.4
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-00773 Plaintext Password Present in the Web logsPriority LOW 31
- TI-2023-00824 Improper input validation in OpenNMS Group MeridianPriority LOW 27
Show all 3 records →
Release · 2023-02-23
The OpenNMS Group Meridian 2020.1.32, 2021.1.24, 2022.1.13
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-00773 Plaintext Password Present in the Web logsPriority LOW 31
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-0867
2026-10-03 Alias added: GHSA-mjv2-6jv4-vrg7

References

Patch 1

https://github.com/OpenNMS/opennms/pull/5765

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-0867

Other 3

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences