CVE-2023-0868

Stealing Cookies using Reflected XSS via graph results

State: Published
Severity: 6.7 Medium
Published: Feb 23, 2023
Updated: Aug 2, 2024
Reserved: Feb 16, 2023

Description

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	OpenNMS

Weaknesses

CWE-20 Improper Input Validation
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
MeridianThe OpenNMS Group	2022.1.0 to before 2023.1.0Affected
HorizonThe OpenNMS Group	29.0.0 through 31.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.