TI-2023-21154 Aliases CVE-2023-40314 GHSA-c6xw-hg9q-3c9f

Improper input validation in OpenNMS Group Horizon

LOW 28CWE-20Published 2023-11-16 · Updated 2024-08-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Moshe Apelbaum for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00435 38th percentileScored 2026-11-07

Fix Fixed org.opennms:opennms-webapp (Maven): 32.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The OpenNMS Group	Meridian	—	—	Not affected	CNA
—	org.opennms:opennms-webapp (Maven)	before 32.0.5	32.0.5	Patch available	GHSA-c6xw-hg9q-3c9f

Meridian VendorThe OpenNMS Group Affected — Fixed in — Not affected CNA
org.opennms:opennms-webapp (Maven) Vendor— Affected before 32.0.5 Fixed in 32.0.5 Patch available GHSA-c6xw-hg9q-3c9f

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	before 32.0.5	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	before 2023.1.9	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions before 32.0.5 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions before 2023.1.9 Vulnerable ·The OpenNMS Group

Remediation

Fix · GHSA-c6xw-hg9q-3c9f org.opennms:opennms-webapp (Maven) Fixed in 32.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-40314
2026-10-03 Alias added: GHSA-c6xw-hg9q-3c9f

References

Patch 1

https://github.com/OpenNMS/opennms/pull/6791

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-40314

Other 2

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences