Read the docs
TI-2023-00827 Aliases CVE-2023-0872GHSA-w5gq-xrrp-3fxf

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

Priority MEDIUM 42CWE-269Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03312 88th percentileScored 2026-11-07
Fix Fixed Horizon (The OpenNMS Group): 32.0.2org.opennms:opennms-webapp-rest (Maven): 32.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupHorizon31.0.8 to before 32.0.232.0.2Patch availableCNA
The OpenNMS GroupMeridian2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5—No fix listedCNA
—org.opennms:opennms-webapp-rest (Maven)31.0.8 to before 32.0.232.0.2Patch availableGHSA-w5gq-xrrp-3fxf
  • Horizon VendorThe OpenNMS Group Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available CNA
  • Meridian VendorThe OpenNMS Group Affected 2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5 Fixed in — No fix listed CNA
  • org.opennms:opennms-webapp-rest (Maven) Vendor— Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available GHSA-w5gq-xrrp-3fxf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*31.0.8 to before 32.0.2VulnerableThe OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5VulnerableThe OpenNMS Group
  • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 31.0.8 to before 32.0.2 Vulnerable ·The OpenNMS Group
  • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5 Vulnerable ·The OpenNMS Group

Remediation

  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 32.0.2
  • Fix · GHSA-w5gq-xrrp-3fxf org.opennms:opennms-webapp-rest (Maven) Fixed in 32.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The OpenNMS Group Horizon 31.0.8, 32.0.2

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-21152 Reflected XSS in multiple JSP files in opennms/opennmsPriority LOW 31
    • TI-2023-21151 Stored XSS in multiple JSP files in opennms/opennmsPriority LOW 31
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0872
  2. 2026-10-03 Alias added: GHSA-w5gq-xrrp-3fxf

References

Patch 1

Advisory 1

Other 3

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
  • TI-2023-21153 Disable BeanShell Interpreter Remote Server Mode CVSS 3.1HIGH 8.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences