CVE-2023-40311: OpenNMS opennms-webapp Cross-site Scripting Vulnerability
Summary
CVE-2023-40311: OpenNMS vulnerable to Cross-site Scripting. Affects org.opennms:opennms-webapp versions >= 31.0.8, < 32.0.2. Fixed in 32.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS is an open-source network management platform that provides network monitoring and management capabilities. The opennms-webapp package is a component of OpenNMS that handles web-based user interfaces. It allows users to access and interact with the network monitoring system through a web browser. However, versions prior to 32.0.2 of opennms-webapp are vulnerable to multiple stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from unsanitized parameters in various JSP files used by OpenNMS Horizon 31.0.8 and earlier versions. Attackers can exploit this vulnerability by injecting malicious scripts into the database, which are then loaded and executed on JSPs or Angular templates. This can lead to the execution of arbitrary code or the theft of sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.7.
How To Fix
Minimum fixed version
32.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the patched versions is the recommended solution.
Conclusion
The OpenNMS opennms-webapp package is vulnerable to stored cross-site scripting (XSS) attacks. Upgrading to the recommended patched versions is crucial to mitigate this vulnerability. It is also important to follow best practices and deploy OpenNMS installations within private networks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms-webapp →
FAQ
OpenNMS is an open-source network management platform that provides network monitoring and management capabilities.
opennms-webapp is a component of OpenNMS that handles web-based user interfaces, allowing users to access and interact with the network monitoring system through a web browser.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code or the theft of sensitive information.
The potential consequences of this vulnerability include the execution of arbitrary code on the affected system, the theft of sensitive information, and the compromise of user accounts.
To mitigate this vulnerability, it is recommended to upgrade to the latest patched versions of OpenNMS, as mentioned in the 'how_to_fix' section. Additionally, ensure that OpenNMS installations are deployed within private networks and not directly accessible from the internet.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms-webapp.
