CVE-2023-40314: OpenNMS Cross-site Scripting vulnerability in org.opennms:opennms-webapp
Summary
CVE-2023-40314: OpenNMS Cross-site Scripting vulnerability. Affects org.opennms:opennms-webapp versions < 32.0.5. Fixed in 32.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS Meridian and Horizon are open-source network management platforms designed for installation within an organization's private networks. They provide comprehensive monitoring and management capabilities for network devices and services. The opennms-webapp package is a crucial component of both Meridian and Horizon, responsible for handling web-based interactions with the platform.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability has been identified in the bootstrap.jsp file of multiple versions of OpenNMS Meridian and Horizon. This vulnerability allows an attacker to exploit a lack of input sanitization and gain access to confidential session information. By injecting malicious scripts into the affected web page, an attacker can potentially steal sensitive data or perform unauthorized actions on behalf of the user. The impact of this vulnerability can be significant, compromising the confidentiality of user sessions and potentially leading to further security breaches.
How To Fix
Minimum fixed version
32.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended updates to address the issue effectively.
Conclusion
The OpenNMS Cross-site Scripting vulnerability in org.opennms:opennms-webapp poses a moderate risk to the security of OpenNMS Meridian and Horizon installations. Upgrading to the recommended versions is crucial to address this vulnerability and ensure the confidentiality of user sessions. It is also important to follow best practices and ensure that OpenNMS installations are not directly accessible from the Internet. For additional support or assistance, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms-webapp →
FAQ
The vulnerability allows an attacker to access confidential session information, potentially leading to unauthorized access, data theft, or further security breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file, without requiring access to the code or installation.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the recommended updates to mitigate the risk.
Yes, this vulnerability can be exploited remotely. However, it is important to note that OpenNMS Meridian and Horizon installations are intended for private networks and should not be directly accessible from the Internet.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms-webapp.
