CVE-2023-40314

Cross-site scripting in bootstrap.jsp

State: Published
Severity: 5.8 Medium
Published: Nov 16, 2023
Updated: Aug 29, 2024
Reserved: Aug 14, 2023

Description

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer

Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks

Moshe Apelbaum

for reporting this issue.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N	OpenNMS

Weaknesses

CWE-20 Improper Input Validation
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
HorizonThe OpenNMS Group	31.0.8 to before 32.0.4Affected
MeridianThe OpenNMS Group	before 2023.1.8Unknown

References

https://github.com/OpenNMS/opennms/pull/6791

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.