CVE-2023-0868CWE-20CWE-79

Stealing Cookies using Reflected XSS via graph results

Medium · published February 23, 2023

CVSS v3.1
6.7
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users

should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and

Horizon installation instructions state that they are intended for installation

within an organization's private networks and should not be directly accessible

from the Internet.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-02-23T14:46Z
EPSS history
Timeline
  • 23 FEB 14:46Z
    Stealing Cookies using Reflected XSS via graph results
    cvelistv5