CVE-2023-0870
High
Description
A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
SeverityHigh
CVSS8.1
Exploit probability—
ProductOpennms Horizon
PublishedMar 22, 2023
First seenMar 22, 2023
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- opennms horizon31.0.6 or later
- opennms meridian2020.1.33, 2021.1.25, 2022.1.14 or later
- org.opennms:opennms-webapp31.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opennms horizon | v < 31.0.6 | 31.0.6 |
| opennms meridian | 2020.1.0 ≤ v < 2020.1.33, 2021.1.0 ≤ v < 2021.1.25, 2022.1.0 ≤ v < 2022.1.14, 2023.1.0 | 2020.1.33, 2021.1.25, 2022.1.14 |
| org.opennms:opennms-webappMaven | v < 31.0.6 | 31.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.