Common vulnerabilities and Exposures (CVE)

Skip to main content

Required CVE Record Information

Description

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 1 Total

Learn more
ScoreSeverityVersionVector String
6.7MEDIUM3.1CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Product Status

Learn more

Versions 4 Total

Default Status: unaffected

affected

  • affected from 2020.1.0 before 2020.1.32 
  • affected from 2021.1.0 before 2021.1.24 
  • affected from 2022.1.0 before 2022.1.13 

unaffected

  • unaffected at 2023.1.0 

Versions 1 Total

Default Status: affected

affected

  • affected from 26.0.0 before 31.0.4 

Credits

  • Baharuddin Zulkifli of NetbyteSEC finder

Updated:

This container includes required additional information provided by the CVE Program for this vulnerability.