CVE-2023-0867

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0867
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0867.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0867
Aliases
Published
2023-02-23T14:49:30Z
Modified
2026-08-12T13:33:46Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Multiple stored and reflected Cross-site Scripting in webapp
Details

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Database specific 
{
    "cna_assigner": "OpenNMS",
    "cwe_ids": [
        "CWE-20",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0867.json"
}
References

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type
GIT
Repo
https://github.com/opennms/opennms
Events
Introduced
0d3624eadab83197935d675b014fa7d8190e0258
Fixed
1ac9921a3b596c930d2faa9b4efecbd32c4cf1ad
Introduced
85e3e796e0953e602941e8fcd6ccaab36f00cacb
Fixed
4d9b446a0b02452f4998aea4ecf4c2b2150ac402
Introduced
2b771b66f9eeaf9b60dd3d8af2833d4bae66bf08
Fixed
85a616323ac6bc1e2f97d22ee07b8665a0a5680f
Introduced
111f358b8997d127657e23e11324031f0997a650
Fixed
9feb41d9ff697443b9b77bdcfa8e618b1350ed76
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2020.1.0"
        },
        {
            "fixed": "2020.1.32"
        },
        {
            "introduced": "2021.1.0"
        },
        {
            "fixed": "2021.1.24"
        },
        {
            "introduced": "2022.1.0"
        },
        {
            "fixed": "2022.1.13"
        },
        {
            "introduced": "26.0.0"
        },
        {
            "fixed": "31.0.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

meridian-foundation-2022.*
meridian-foundation-2022.1.0-1
meridian-foundation-2022.1.1-1
meridian-foundation-2022.1.10-1
meridian-foundation-2022.1.11-1
meridian-foundation-2022.1.12-1
meridian-foundation-2022.1.2-1
meridian-foundation-2022.1.3-1
meridian-foundation-2022.1.4-1
meridian-foundation-2022.1.5-1
meridian-foundation-2022.1.6-1
meridian-foundation-2022.1.7-1
meridian-foundation-2022.1.8-1
meridian-foundation-2022.1.9-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0867.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "206425191555369378448459867943500113004",
            "length": 185
        },
        "id": "CVE-2023-0867-0e0e561b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/9feb41d9ff697443b9b77bdcfa8e618b1350ed76",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java",
            "function": "getFrameworkUrl"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34429318019951841524344332265895841257",
                "69464526689932505471209434272048820764",
                "263236452842351482963584900797504484320",
                "167767907474950385554340535886404424610"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-0867-ccaa9e5b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/9feb41d9ff697443b9b77bdcfa8e618b1350ed76",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T13:33:46Z"