CVE-2023-0867CWE-20CWE-79

Multiple stored and reflected Cross-site Scripting in webapp

Medium · published February 23, 2023

CVSS v3.1
6.7
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users

should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and

Horizon installation instructions state that they are intended for installation

within an organization's private networks and should not be directly accessible

from the Internet.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-02-23T14:49Z
EPSS history
Timeline
  • 23 FEB 14:49Z
    Multiple stored and reflected Cross-site Scripting in webapp
    cvelistv5