CVE-2023-0815: OpenNMS Potential Insertion of Sensitive Information into Log File Vulnerability
Summary
CVE-2023-0815: OpenNMS has potential Insertion of Sensitive Information into Log File vulnerability. Affects org.opennms:opennms versions < 31.0.4. Fixed in 31.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS is an open-source network management platform that provides monitoring and management capabilities for various network devices and services. It is widely used in enterprise environments to ensure the availability and performance of network infrastructure. OpenNMS Meridian and Horizon are two versions of OpenNMS that are affected by a potential insertion of sensitive information into Jetty log files vulnerability.
Vulnerability Detail
The vulnerability in OpenNMS allows for the potential insertion of sensitive information, such as usernames and passwords, into Jetty log files. This can occur if the logging level is set to debug. An attacker with access to the log files could extract the sensitive information, leading to unauthorized access or disclosure of credentials. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 31.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
31.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the logging configuration to disable debug-level logging or redirect the log output to a secure location that is inaccessible to unauthorized users. Here is an example of how to modify the logback.xml configuration file to disable debug-level logging:
<configuration>
<appender name="FILE" class="ch.qos.logback.core.FileAppender">
<file>/path/to/secure/log/file.log</file>
<encoder>
<pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
</encoder>
</appender>
<root level="INFO">
<appender-ref ref="FILE" />
Conclusion
The potential insertion of sensitive information into log files vulnerability in OpenNMS Meridian and Horizon could lead to the unauthorized disclosure of usernames and passwords. It is crucial to update to the latest version of OpenNMS and review the logging configuration to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms →
FAQ
OpenNMS is an open-source network management platform that provides monitoring and management capabilities for various network devices and services.
Multiple versions of OpenNMS Meridian and Horizon are affected by this vulnerability. Users should update to version 31.0.4 or later to mitigate the risk.
The vulnerability could allow an attacker to extract sensitive information, such as usernames and passwords, from Jetty log files. This could lead to unauthorized access or disclosure of credentials.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, update OpenNMS to version 31.0.4 or later and ensure that the logging level is not set to debug in production environments.
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms.
