CVE-2023-0846

MEDIUM6.1EPSS 0.29%

OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting

Published: 2/22/2023Modified: 11/8/2023

Description

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information.

Affected packages (1)

Maven/org.opennms:opennmsfrom 0, < 31.0.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-0846
PATCHhttps://github.com/OpenNMS/opennms
WEBhttps://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
WEBhttps://github.com/OpenNMS/opennms/pull/5506/files
WEBhttps://issues.opennms.org/browse/NMS-14877