CVE-2023-0868 - Stealing Cookies using Reflected XSS via graph results

Back Back to CVE browser

MEDIUM

Stealing Cookies using Reflected XSS via graph results

Published Feb 23, 2023

6.7

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Affected products

Vendor The OpenNMS Group Product Horizon Default
unknown
Affected
- ≥ 29.0.0, ≤ 31.0.3
Vendor The OpenNMS Group Product Meridian Default
unknown
Affected
- ≥ 2022.1.0, < 2023.1.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
The OpenNMS Group	Horizon	unknown	Affected ≥ 29.0.0, ≤ 31.0.3
The OpenNMS Group	Meridian	unknown	Affected ≥ 2022.1.0, < 2023.1.0

Remediation

Vendor solution

Upgrade to the latest version of Meridian or Horizon.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-79

Cross-site Scripting (XSS)

References (6)

Link	Providers	Tags
https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13		Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0704		Advisory
https://github.com/OpenNMS/opennms/commit/a47e193f820c222b309763b508009e54b2f0e7f5
https://github.com/OpenNMS/opennms/pull/5740		PatchVendor Advisory
https://github.com/advisories/GHSA-g57g-rvpg-2f2c		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-0868