Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2023-0868: OpenNMS Meridian/Horizon can leak session cookies
CVE-2023-0868 · published 3 years ago
Summary
A flaw in the web interface of OpenNMS Meridian and Horizon could let a malicious webpage capture users' login cookies when they view crafted graph results. This could let an attacker impersonate users and access the monitoring system. Upgrade to Meridian 2023.1.0 or later, or Horizon 31.0.4, and keep the applications behind your private network.
What to do
- Update opennms org.opennms:opennms-webapp to version 31.0.4.
- Update opennms horizon to version 31.0.4 or later.
- Update opennms meridian to version 2023.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | opennms | org.opennms:opennms-webapp |
< 31.0.4 Fix: upgrade to 31.0.4
|
| – | opennms | horizon |
< 31.0.4 cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* |
| – | opennms | meridian |
< 2023.1.0 cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* |
Original advisory text
Stealing Cookies using Reflected XSS via graph results
Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.
References
- https://github.com/OpenNMS/opennms/commit/a47e193f820c222b309763b508009e54b2f0e7...
- https://github.com/advisories/GHSA-g57g-rvpg-2f2c
- https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-... URL
- https://github.com/OpenNMS URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0868.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-0868 Vendor Advisory
- https://github.com/OpenNMS/opennms/pull/5740 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.7
Medium
Type
CWE-79Cross-site Scripting (XSS)
CWE-20Improper Input Validation
Timeline
Published23 Feb 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta