CVE-2023-0846

Published: Feb 22, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Affected (2)

Products: Opennms: Horizon, Meridian

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Opennms Horizon	Before 31.0.4
Opennms Meridian	Before 2023.1.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13

Source: security@opennms.com

Release Notes

https://github.com/OpenNMS/opennms/pull/5506/files

Source: security@opennms.com

Patch

https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/OpenNMS/opennms/pull/5506/files

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.