GHSA-mjv2-6jv4-vrg7

OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0867

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opennms:opennms	< 31.0.4	31.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-0867 advisory
https://github.com/OpenNMS/opennms/pull/5765 web
https://github.com/OpenNMS/opennms/commit/9a366e6822479579e642b58058568af37658baba web
https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13 web
https://github.com/OpenNMS/opennms package