CVE-2023-0870: OpenNMS Meridian and Horizon Cross-Site Request Forgery
Summary
CVE-2023-0870: OpenNMS Meridian and Horizon vulnerable to Cross-Site Request Forgery. Affects org.opennms:opennms-webapp versions < 31.0.6. Fixed in 31.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS Meridian and Horizon are open-source network management platforms designed for installation within an organization's private networks. They provide various features for monitoring and managing network resources. However, multiple versions of these platforms are vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in OpenNMS Meridian and Horizon allows an attacker to manipulate a form and trick authenticated users into performing unintended actions. This can lead to unauthorized access to confidential information and compromise the integrity of the system. The vulnerability has a CVSS score of 6.7, indicating a moderate severity level.
How To Fix
Minimum fixed version
31.0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to follow best practices for secure network management, such as restricting direct access to OpenNMS Meridian and Horizon from the internet and implementing strong authentication mechanisms.
Conclusion
OpenNMS Meridian and Horizon are susceptible to a CSRF vulnerability that can lead to unauthorized access and compromise of confidential information. To mitigate this risk, it is crucial to upgrade to the latest secure versions of the platforms and follow best practices for secure network management. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms-webapp →
FAQ
OpenNMS Meridian and Horizon are open-source network management platforms used for monitoring and managing network resources within an organization's private networks.
Cross-Site Request Forgery is an attack that tricks authenticated users into performing unintended actions without their consent. In the case of OpenNMS Meridian and Horizon, it can lead to unauthorized access and compromise of confidential information.
The CSRF vulnerability in OpenNMS Meridian and Horizon can allow attackers to gain access to confidential information and compromise the integrity of the system. This can result in unauthorized data disclosure, unauthorized actions performed on behalf of authenticated users, and potential system compromise.
To fix the vulnerability, it is recommended to upgrade to the latest secure versions of OpenNMS Meridian or Horizon (Meridian 2023.1.1 or Horizon 31.0.6 or newer). These versions include patches that address the CSRF vulnerability.
While no specific workarounds are mentioned for this vulnerability, it is important to follow best practices for secure network management. This includes restricting direct access to OpenNMS Meridian and Horizon from the internet and implementing strong authentication mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms-webapp.
