CVE-2023-0872: OpenNMS privilege elevation vulnerability in org.opennms:opennms-webapp-rest
Summary
CVE-2023-0872: OpenNMS privilege elevation vulnerability. Affects org.opennms:opennms-webapp-rest versions >= 31.0.8, < 32.0.2. Fixed in 32.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.opennms:opennms-webapp-rest is a Maven package that provides the Horizon REST API for OpenNMS. It allows users to interact with OpenNMS Horizon, a network management platform. The package is vulnerable to privilege elevation, which can lead to unauthorized access and potential misuse of the API.
Vulnerability Detail
The Horizon REST API in OpenNMS Horizon 31.0.8 and earlier versions up to 32.0.2 on multiple platforms is susceptible to an elevation of privilege vulnerability. This vulnerability allows an attacker to escalate their privileges and gain unauthorized access to sensitive information or perform malicious actions. The issue has a CVSS score of 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
32.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched versions mentioned above.
Conclusion
The org.opennms:opennms-webapp-rest package in OpenNMS Horizon is vulnerable to privilege elevation, which can lead to unauthorized access and potential misuse of the Horizon REST API. It is crucial to upgrade to the recommended patched versions to mitigate this vulnerability. Keep the installation within a private network and follow best practices for securing network management platforms. For additional support, contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms-webapp-rest →
FAQ
This vulnerability allows an attacker to elevate their privileges and gain unauthorized access to the Horizon REST API, potentially leading to unauthorized actions, data breaches, or further exploitation of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
The only known mitigation is to upgrade to the patched versions mentioned in the 'how_to_fix' section. It is crucial to keep the OpenNMS installation within a private network and not expose it directly to the Internet.
This vulnerability was reported by Erik Wynter and acknowledged by OpenNMS.
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms-webapp-rest.
