CVE-2023-0872 json
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
published 2023-08-14 3 y ago modified 2026-06-17 4 mo ago also GHSA-w5gq-xrrp-3fxf , EUVD-2023-2369
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Metasploit
Summary
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
Patch / fix
- maven org.opennms:opennms-webapp-rest 32.0.2
- The OpenNMS Group Horizon 32.0.2
- github.com/OpenNMS/opennms@e59b0dd commit
- github.com/OpenNMS/opennms#6354 pull request
Timeline
- First public exploit (Metasploit exploit/linux/http/opennms_horizon_authenticated_rce)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
3.31% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/opennms_horizon_authenticated_rce OpenNMS Horizon Authenticated RCE metasploit exploit, excellent rank, 2023-07-01
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opennms:opennms-webapp-rest | >=31.0.8, <32.0.2 |
32.0.2 |
Affected products
- The OpenNMS Group Horizon
- The OpenNMS Group Meridian
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
Sources
- CVE List CVE-2023-0872
- GitHub Advisory GHSA-w5gq-xrrp-3fxf
- NVD CVE-2023-0872
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.