CVE-2023-0846 json
Unauthenticated, stored XSS in display of alarm reduction-key
published 2023-02-22 3 y ago modified 2026-06-17 4 mo ago also GHSA-79jr-8fhm-8wv3 , EUVD-2023-0651
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Patch / fix
- maven org.opennms:opennms 31.0.3
- opennms horizon 31.0.4
- opennms meridian 2023.1.0
- github.com/OpenNMS/opennms#5506 pull request
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opennms:opennms | <31.0.3 |
31.0.3 |
Affected products
- The OpenNMS Group Horizon
- The OpenNMS Group Meridian
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/OpenNMS/opennms/pull/5506/files
web, patch
-
docs.opennms.com
/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-0846
advisory
-
github.com
/OpenNMS/opennms
package
-
issues.opennms.org
/browse/NMS-14877
web
Sources
- CVE List CVE-2023-0846
- GitHub Advisory GHSA-79jr-8fhm-8wv3
- NVD CVE-2023-0846
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.