CVE-2023-0867: OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting
Summary
CVE-2023-0867: OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting. Affects org.opennms:opennms versions < 31.0.4. Fixed in 31.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS Meridian and Horizon are open-source network management platforms that provide monitoring and management capabilities for various network devices. These platforms are widely used in enterprise environments to ensure the stability and performance of network infrastructure. However, multiple versions of OpenNMS Meridian and Horizon are susceptible to stored and reflected cross-site scripting (XSS) vulnerabilities in their web application JSP pages. These vulnerabilities can potentially allow an attacker to gain access to confidential session information, posing a significant risk to the security and privacy of the affected systems.
Vulnerability Detail
The identified XSS vulnerabilities in OpenNMS Meridian and Horizon stem from insufficient input sanitization and validation in the web application JSP pages. Attackers can exploit these vulnerabilities by injecting malicious scripts or code into user-supplied input fields, which are then executed within the context of the victim's browser. This can lead to various malicious activities, including the theft of sensitive information, session hijacking, and the execution of arbitrary code. The severity of these vulnerabilities is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 31.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
31.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
OpenNMS Meridian and Horizon versions prior to 31.0.4 are susceptible to stored and reflected XSS vulnerabilities, which can lead to unauthorized access and data theft. It is crucial for users to update their installations to the latest versions to mitigate these risks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms →
FAQ
The vulnerabilities can allow attackers to access confidential session information, potentially leading to unauthorized access, data theft, and other malicious activities.
No, only versions prior to 31.0.4 are vulnerable. It is crucial to update to the latest version to mitigate the risk.
At the time of this advisory, there are no known public exploits targeting these vulnerabilities. However, it is essential to apply the recommended patches and updates to prevent any potential exploitation.
Yes, these vulnerabilities can be exploited remotely by sending specially crafted requests to the affected web application.
No, the recommended solution is to update to the latest version of OpenNMS Meridian or Horizon.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms.
