CVE-2023-0868

MEDIUM6.1EPSS 0.52%

OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting

Published: 2/23/2023Modified: 11/8/2023

Description

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies.

Affected packages (1)

Maven/org.opennms:opennms-webappfrom 0, < 31.0.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-0868
PATCHhttps://github.com/OpenNMS/opennms
WEBhttps://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
WEBhttps://github.com/OpenNMS/opennms/commit/a47e193f820c222b309763b508009e54b2f0e7f5
WEBhttps://github.com/OpenNMS/opennms/pull/5740