CVE-2023-0846: OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting
Summary
CVE-2023-0846: OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting. Affects org.opennms:opennms versions < 31.0.3. Fixed in 31.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS Horizon and Meridian are open-source network management platforms. They provide a range of features for monitoring and managing network devices, including alarm reduction keys. These keys are used to display and categorize alarms. However, multiple versions of OpenNMS Horizon and Meridian are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability allows an attacker to inject malicious code into the alarm reduction key display, potentially gaining access to confidential session information.
Vulnerability Detail
The vulnerability arises due to a lack of proper input validation and sanitization in the display of alarm reduction keys. An unauthenticated attacker can exploit this vulnerability by injecting malicious code into the alarm reduction key field. When the alarm reduction keys are displayed, the injected code will be executed in the context of the user's session, potentially leading to the theft of sensitive information or unauthorized actions. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 31.0.3 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version.
Conclusion
OpenNMS Horizon and Meridian versions prior to 31.0.3 are vulnerable to a stored cross-site scripting (XSS) attack. This allows an attacker to inject and execute malicious code in the context of a user's session. To mitigate this vulnerability, it is crucial to upgrade to OpenNMS Horizon or Meridian version 31.0.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms →
FAQ
The vulnerability allows an attacker to execute malicious code in the context of a user's session, potentially leading to the theft of sensitive information or unauthorized actions.
No, the vulnerability can be exploited by an unauthenticated attacker.
No, only versions prior to 31.0.3 are affected. It is recommended to upgrade to the latest patched version.
No, there is no known workaround. Upgrading to the patched version is the recommended solution.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms.
