CVE-2023-40314 — Cross-site scripting in bootstrap.jsp

Description (CNA)

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Moshe Apelbaum for reporting this issue.

Affected (CNA)

Vendor / product	Versions
The OpenNMS Group / Horizon	affected 31.0.8 before 32.0.4
The OpenNMS Group / Meridian	unknown 0 before 2023.1.8

CWE

CWE-20, CWE-79

References

https://github.com/OpenNMS/opennms/pull/6791

ADP enrichment

CVE

No English description supplied.

https://github.com/OpenNMS/opennms/pull/6791

CISA-ADP

No English description supplied.

No references supplied.