Read the docs
TI-2023-00824 Aliases CVE-2023-0869GHSA-7v39-jjj6-j4j4

Improper input validation in OpenNMS Group Meridian

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

EPSS 0.00408 35th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.opennms:opennms-web-api (Maven)up to 31.0.3—No fix listedGHSA-7v39-jjj6-j4j4
  • org.opennms:opennms-web-api (Maven) Vendor— Affected up to 31.0.3 Fixed in — No fix listed GHSA-7v39-jjj6-j4j4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*before 31.0.4VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*before 2023.1.0VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions before 31.0.4 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions before 2023.1.0 Vulnerable ·The OpenNMS Group

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The OpenNMS Group Horizon 31.0.4

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-00773 Plaintext Password Present in the Web logsPriority LOW 31
    • TI-2023-00822 Multiple stored and reflected Cross-site Scripting in webappPriority LOW 30
    Show all 3 records →
  • Release ·

    The OpenNMS Group Meridian 2023.1.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-00823 Stealing Cookies using Reflected XSS via graph resultsPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0869
  2. 2026-10-03 Alias added: GHSA-7v39-jjj6-j4j4

References

Patch 1

Advisory 1

Other 1

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences