CVE-2023-40315: OpenNMS privilege escalation vulnerability in org.opennms:opennms-webapp-rest
Summary
CVE-2023-40315: OpenNMS privilege escalation vulnerability. Affects org.opennms:opennms-webapp-rest versions >= 31.0.8, < 32.0.2. Fixed in 32.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.opennms:opennms-webapp-rest is a Maven package that is part of OpenNMS, an open-source network management platform. It provides RESTful web services for managing network resources. This package is vulnerable to a privilege escalation vulnerability.
Vulnerability Detail
The vulnerability in org.opennms:opennms-webapp-rest allows any user with the ROLE_FILESYSTEM_EDITOR privilege to escalate their privileges to ROLE_ADMIN or any other role. This can lead to unauthorized access and control over the network management platform. The vulnerability affects OpenNMS Horizon versions 31.0.8 and earlier, as well as related Meridian versions. The severity of this vulnerability is moderate, with a CVSS score of 5.3.
How To Fix
Minimum fixed version
32.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The privilege escalation vulnerability in org.opennms:opennms-webapp-rest can be mitigated by upgrading to the recommended versions. It is crucial to follow the installation instructions and restrict access to OpenNMS installations within private networks. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms-webapp-rest →
FAQ
The vulnerability allows users with lower privileges to gain unauthorized access and control over the network management platform, potentially leading to data breaches and system compromise.
Organizations using OpenNMS Horizon versions 31.0.8 and earlier, as well as related Meridian versions, are affected by this vulnerability if they have users with the ROLE_FILESYSTEM_EDITOR privilege.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to apply the recommended fixes to prevent any potential exploitation.
No, the recommended solution is to upgrade to the specified versions that contain the necessary patches to address the privilege escalation vulnerability.
This vulnerability was reported by Erik Wynter and acknowledged by the OpenNMS team. They have provided the necessary fixes in the updated versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms-webapp-rest.
