TI-2023-21152 Aliases CVE-2023-40312 GHSA-chgr-j2p9-jjh8

Reflected XSS in multiple JSP files in opennms/opennms

LOW 31CWE-79Published 2023-08-14 · Updated 2024-09-27

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00643 51st percentileScored 2026-11-07

Fix Fixed Horizon (The OpenNMS Group): 32.0.2org.opennms:opennms-webapp (Maven): 32.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The OpenNMS Group	Horizon	31.0.8 to before 32.0.2	32.0.2	Patch available	CNA
The OpenNMS Group	Meridian	2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5	—	No fix listed	CNA
—	org.opennms:opennms-webapp (Maven)	31.0.8 to before 32.0.2	32.0.2	Patch available	GHSA-chgr-j2p9-jjh8

Horizon VendorThe OpenNMS Group Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available CNA
Meridian VendorThe OpenNMS Group Affected 2020.0.0 – 2020.1.37; 2021.0.0 – 2021.1.29; 2022.0.0 – 2022.1.18; 2023.0.0 – 2023.1.5 Fixed in — No fix listed CNA
org.opennms:opennms-webapp (Maven) Vendor— Affected 31.0.8 to before 32.0.2 Fixed in 32.0.2 Patch available GHSA-chgr-j2p9-jjh8

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	31.0.8 to before 32.0.2	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	before 2020.1.38; 2022.1.0 to before 2022.1.19; 2023.1.0 to before 2023.1.6	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 31.0.8 to before 32.0.2 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions before 2020.1.38; 2022.1.0 to before 2022.1.19; 2023.1.0 to before 2023.1.6 Vulnerable ·The OpenNMS Group

Remediation

Fix · CNA Horizon (The OpenNMS Group) Fixed in 32.0.2
Fix · GHSA-chgr-j2p9-jjh8 org.opennms:opennms-webapp (Maven) Fixed in 32.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-08-14
The OpenNMS Group Horizon 31.0.8, 32.0.2
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/usersPriority MEDIUM 42
- TI-2023-21151 Stored XSS in multiple JSP files in opennms/opennmsPriority LOW 31
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-40312
2026-10-03 Alias added: GHSA-chgr-j2p9-jjh8
2026-10-21 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/OpenNMS/opennms/pull/6356

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-40312

Other 3

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences