CVE-2023-0872

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-0872

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0872.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-0872

Aliases

GHSA-w5gq-xrrp-3fxf

Published

2023-08-14T17:21:58.203Z

Modified

2026-07-15T02:08:04.260568292Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator

Summary

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

Details

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks Erik Wynter for reporting this issue.

Database specific

{
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0872.json",
    "cna_assigner": "OpenNMS"
}

References

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type

GIT

Repo

https://github.com/opennms/opennms

Events

Introduced

29913a2510b6a0a2d0ceff75540ee848a432aacd

Fixed

5bbc4b368d0785d6d574713cb41c42c5a5f4421d

Introduced

Last affected

5e83fab9fd98115b3623f9988afb6ae5f6f2a5a8

Last affected

ab124d2c8d68dc029d8be1766873b1782b080576

Last affected

366e8dda0ca8ea6c133c7121d241fc74d27b6d91

Last affected

58080b98fae039bee8c36a59c4c549f3241158c9

Database specific

{
    "cpe": [
        "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "31.0.8"
        },
        {
            "fixed": "32.0.2"
        },
        {
            "introduced": "2020.0.0"
        },
        {
            "last_affected": "2020.1.37"
        },
        {
            "introduced": "2021.0.0"
        },
        {
            "last_affected": "2021.1.29"
        },
        {
            "introduced": "2022.0.0"
        },
        {
            "last_affected": "2022.1.18"
        },
        {
            "introduced": "2023.0.0"
        },
        {
            "last_affected": "2023.1.5"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

meridian-foundation-2020.*

meridian-foundation-2020.1.10-1

meridian-foundation-2020.1.11-1

meridian-foundation-2020.1.12-1

meridian-foundation-2020.1.13-1

meridian-foundation-2020.1.14-1

meridian-foundation-2020.1.15-1

meridian-foundation-2020.1.16-1

meridian-foundation-2020.1.17-1

meridian-foundation-2020.1.18-1

meridian-foundation-2020.1.19-1

meridian-foundation-2020.1.20-1

meridian-foundation-2020.1.21-1

meridian-foundation-2020.1.22-1

meridian-foundation-2020.1.23-1

meridian-foundation-2020.1.24-1

meridian-foundation-2020.1.25-1

meridian-foundation-2020.1.26-1

meridian-foundation-2020.1.27-1

meridian-foundation-2020.1.28-1

meridian-foundation-2020.1.29-1

meridian-foundation-2020.1.30-1

meridian-foundation-2020.1.31-1

meridian-foundation-2020.1.32-1

meridian-foundation-2020.1.33-1

meridian-foundation-2020.1.34-1

meridian-foundation-2020.1.35-1

meridian-foundation-2020.1.36-1

meridian-foundation-2020.1.37-1

meridian-foundation-2021.*

meridian-foundation-2021.1.10-1

meridian-foundation-2021.1.11-1

meridian-foundation-2021.1.12-1

meridian-foundation-2021.1.14-1

meridian-foundation-2021.1.15-1

meridian-foundation-2021.1.16-1

meridian-foundation-2021.1.17-1

meridian-foundation-2021.1.18-1

meridian-foundation-2021.1.19-1

meridian-foundation-2021.1.2-1

meridian-foundation-2021.1.20-1

meridian-foundation-2021.1.21-1

meridian-foundation-2021.1.22-1

meridian-foundation-2021.1.23-1

meridian-foundation-2021.1.24-1

meridian-foundation-2021.1.25-1

meridian-foundation-2021.1.26-1

meridian-foundation-2021.1.27-1

meridian-foundation-2021.1.28-1

meridian-foundation-2021.1.29-1

meridian-foundation-2021.1.3-1

meridian-foundation-2021.1.5-1

meridian-foundation-2021.1.6-1

meridian-foundation-2021.1.7-1

meridian-foundation-2021.1.8-1

meridian-foundation-2021.1.9-1

meridian-foundation-2022.*

meridian-foundation-2022.1.0-1

meridian-foundation-2022.1.1-1

meridian-foundation-2022.1.10-1

meridian-foundation-2022.1.11-1

meridian-foundation-2022.1.12-1

meridian-foundation-2022.1.13-1

meridian-foundation-2022.1.14-1

meridian-foundation-2022.1.15-1

meridian-foundation-2022.1.16-1

meridian-foundation-2022.1.17-1

meridian-foundation-2022.1.18-1

meridian-foundation-2022.1.2-1

meridian-foundation-2022.1.3-1

meridian-foundation-2022.1.4-1

meridian-foundation-2022.1.5-1

meridian-foundation-2022.1.6-1

meridian-foundation-2022.1.7-1

meridian-foundation-2022.1.8-1

meridian-foundation-2022.1.9-1

meridian-foundation-2023.*

meridian-foundation-2023.1.0-1

meridian-foundation-2023.1.1-1

meridian-foundation-2023.1.2-1

meridian-foundation-2023.1.3-1

meridian-foundation-2023.1.4-1

meridian-foundation-2023.1.5-1

opennms-1.*

opennms-1.11.1-1

opennms-1.11.3-1

opennms-1.13.2-1

opennms-1.9.0-1

opennms-1.9.4-1

opennms-1.9.93-1

opennms-20.*

opennms-20.0.0-1

opennms-25.*

opennms-25.0.0-1

opennms-25.1.0-1

opennms-25.1.1-1

opennms-25.1.2-1

opennms-25.2.0-1

opennms-25.2.1-1

opennms-28.*

opennms-28.0.1-1

opennms-28.0.2-1

opennms-28.0.2-2

opennms-28.1.0-1

opennms-28.1.1-1

opennms-29.*

opennms-29.0.0-1

opennms-29.0.1-1

opennms-29.0.2-1

opennms-31.*

opennms-31.0.0-1

opennms-31.0.1-1

opennms-32.*

opennms-32.0.0-1

opennms-32.0.1-1

space-integration-12.*

space-integration-12.2-code-freeze

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0872.json"