Read the docs
TI-2023-00825 Aliases CVE-2023-0870GHSA-jxr6-7qg5-8wv6

Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

Priority LOW 35CWE-352Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed Horizon (The OpenNMS Group): 31.0.6org.opennms:opennms-webapp (Maven): 31.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupHorizon—31.0.6Patch availableCNA
—org.opennms:opennms-webapp (Maven)before 31.0.631.0.6Patch availableGHSA-jxr6-7qg5-8wv6
  • Horizon VendorThe OpenNMS Group Affected — Fixed in 31.0.6 Patch available CNA
  • org.opennms:opennms-webapp (Maven) Vendor— Affected before 31.0.6 Fixed in 31.0.6 Patch available GHSA-jxr6-7qg5-8wv6

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*before 31.0.6VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*2020.1.0 to before 2020.1.33; 2021.1.0 to before 2021.1.25; 2022.1.0 to before 2022.1.14VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:2023.1.0:*:*:*:*:*:*:*2023.1.0VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions before 31.0.6 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2020.1.0 to before 2020.1.33; 2021.1.0 to before 2021.1.25; 2022.1.0 to before 2022.1.14 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:2023.1.0:*:*:*:*:*:*:* Versions 2023.1.0 Vulnerable ·The OpenNMS Group

Remediation

  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 31.0.6
  • Fix · GHSA-jxr6-7qg5-8wv6 org.opennms:opennms-webapp (Maven) Fixed in 31.0.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0870
  2. 2026-10-03 Alias added: GHSA-jxr6-7qg5-8wv6

References

Patch 1

Advisory 1

Other 2

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences