Lucene search

OpenNMSCVE-2023-40612

HistoryAug 23, 2023 - 7:15 p.m.

CVE-2023-40612

2023-08-2319:15:08

CWE-91

OpenNMS

web.nvd.nist.gov

openmns

horizon

xxe injection

file editor

vulnerability

upgrade

meridian 2023.1.5

security

nvd

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

9.0%

JSON

In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization’s private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

Affected configurations

Nvd

Node

opennmshorizonRange31.0.8–32.0.2

opennmsmeridianRange2023.0.0–2023.1.5

VendorProductVersionCPE
opennmshorizon*cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*
opennmsmeridian*cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opennms	horizon	*	cpe:2.3:a:opennms:horizon::::::::
opennms	meridian	*	cpe:2.3:a:opennms:meridian::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux"
    ],
    "product": "Horizon",
    "repo": "https://github.com/OpenNMS/opennms",
    "vendor": "The OpenNMS Group",
    "versions": [
      {
        "lessThan": "32.0.2",
        "status": "affected",
        "version": "31.0.8",
        "versionType": "maven"
      },
      {
        "lessThan": "31.0.8",
        "status": "unknown",
        "version": "0",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux"
    ],
    "product": "Meridian",
    "repo": "https://github.com/OpenNMS/opennms",
    "vendor": "The OpenNMS Group",
    "versions": [
      {
        "lessThan": "2023.1.5",
        "status": "affected",
        "version": "2023.0.0",
        "versionType": "maven"
      },
      {
        "lessThan": "2023.0.0",
        "status": "unknown",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.5

github.com/OpenNMS/opennms/pull/6288

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-40612