Read the docs
TI-2023-00826 Aliases CVE-2023-0871GHSA-2qc8-r663-v864

An XML External Entity injection vulnerability

Priority LOW 28CWE-611Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed Horizon (The OpenNMS Group): 32.0.2Meridian (The OpenNMS Group): 2023.1.6, 2022.1.19, 2021.1.30 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupHorizon31.0.8 to before 32.0.232.0.2Patch availableCNA
The OpenNMS GroupMeridian2023.0.0 to before 2023.1.6; 2022.0.0 to before 2022.1.19; 2021.0.0 to before 2021.1.30; 2020.0.0 to before 2020.1.382023.1.6, 2022.1.19, 2021.1.30, 2020.1.38Patch availableCNA
—org.opennms.core:org.opennms.core.xml (Maven)31.0.8 to before 32.0.232.0.2Patch availableGHSA-2qc8-r663-v864
  • Horizon VendorThe OpenNMS Group Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available CNA
  • Meridian VendorThe OpenNMS Group Affected 2023.0.0 to before 2023.1.6; 2022.0.0 to before 2022.1.19; 2021.0.0 to before 2021.1.30; 2020.0.0 to before 2020.1.38 Fixed in 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 Patch available CNA
  • org.opennms.core:org.opennms.core.xml (Maven) Vendor— Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available GHSA-2qc8-r663-v864

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*32.0.0 to before 32.0.2VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:horizon:31.0.8:*:*:*:*:*:*:*31.0.8VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*2020.0.0 to before 2020.1.38; 2021.0.0 to before 2021.1.30; 2022.1.0 to before 2022.1.9; 2023.0.0 to before 2023.1.6VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 32.0.0 to before 32.0.2 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:horizon:31.0.8:*:*:*:*:*:*:* Versions 31.0.8 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2020.0.0 to before 2020.1.38; 2021.0.0 to before 2021.1.30; 2022.1.0 to before 2022.1.9; 2023.0.0 to before 2023.1.6 Vulnerable ·The OpenNMS Group

Remediation

  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 32.0.2
  • Fix · CNA Meridian (The OpenNMS Group) Fixed in 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38
  • Fix · GHSA-2qc8-r663-v864 org.opennms.core:org.opennms.core.xml (Maven) Fixed in 32.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0871
  2. 2026-10-03 Alias added: GHSA-2qc8-r663-v864

References

Patch 1

Advisory 1

Other 3

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences