CVE-2023-0869CWE-20CWE-79

Cross-site scripting in outage/list.htm

Medium · published February 23, 2023

CVSS v3.1
5.8
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.

Meridian

and Horizon installation instructions state that they are intended for

installation within an organization's private networks and should not be

directly accessible from the Internet.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 34.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-02-23T14:43Z
EPSS history
Timeline
  • 23 FEB 14:43Z
    Cross-site scripting in outage/list.htm
    cvelistv5