CVE-2023-40311

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-40311

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40311.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-40311

Aliases

GHSA-qfw7-pfxx-h9q2

Published

2023-08-14T17:31:29.877Z

Modified

2026-07-09T10:58:34.788503Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Stored XSS in multiple JSP files in opennms/opennms

Details

Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40311.json",
    "cna_assigner": "OpenNMS",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type

GIT

Repo

https://github.com/opennms/opennms

Events

Introduced

29913a2510b6a0a2d0ceff75540ee848a432aacd

Fixed

5bbc4b368d0785d6d574713cb41c42c5a5f4421d

Introduced

Fixed

7d988a553d24fef53c503cedfe6a8436bf5cf69f

Introduced

2b771b66f9eeaf9b60dd3d8af2833d4bae66bf08

Fixed

2c624fc642309b2f7b7e0bf560be284283bf267e

Introduced

3619e2c44a6e3efe312f8f7f46a9d06955e01bb0

Fixed

c7917e798bc6c70d01d87cd55d62541c8edefb29

Database specific

{
    "cpe": [
        "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "31.0.8"
        },
        {
            "fixed": "32.0.2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2020.1.38"
        },
        {
            "introduced": "2022.1.0"
        },
        {
            "fixed": "2022.1.19"
        },
        {
            "introduced": "2023.1.0"
        },
        {
            "fixed": "2023.1.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

meridian-foundation-2020.*

meridian-foundation-2020.1.10-1

meridian-foundation-2020.1.11-1

meridian-foundation-2020.1.12-1

meridian-foundation-2020.1.13-1

meridian-foundation-2020.1.14-1

meridian-foundation-2020.1.15-1

meridian-foundation-2020.1.16-1

meridian-foundation-2020.1.17-1

meridian-foundation-2020.1.18-1

meridian-foundation-2020.1.19-1

meridian-foundation-2020.1.20-1

meridian-foundation-2020.1.21-1

meridian-foundation-2020.1.22-1

meridian-foundation-2020.1.23-1

meridian-foundation-2020.1.24-1

meridian-foundation-2020.1.25-1

meridian-foundation-2020.1.26-1

meridian-foundation-2020.1.27-1

meridian-foundation-2020.1.28-1

meridian-foundation-2020.1.29-1

meridian-foundation-2020.1.30-1

meridian-foundation-2020.1.31-1

meridian-foundation-2020.1.32-1

meridian-foundation-2020.1.33-1

meridian-foundation-2020.1.34-1

meridian-foundation-2020.1.35-1

meridian-foundation-2020.1.36-1

meridian-foundation-2020.1.37-1

meridian-foundation-2022.*

meridian-foundation-2022.1.0-1

meridian-foundation-2022.1.1-1

meridian-foundation-2022.1.10-1

meridian-foundation-2022.1.11-1

meridian-foundation-2022.1.12-1

meridian-foundation-2022.1.13-1

meridian-foundation-2022.1.14-1

meridian-foundation-2022.1.15-1

meridian-foundation-2022.1.16-1

meridian-foundation-2022.1.17-1

meridian-foundation-2022.1.18-1

meridian-foundation-2022.1.2-1

meridian-foundation-2022.1.3-1

meridian-foundation-2022.1.4-1

meridian-foundation-2022.1.5-1

meridian-foundation-2022.1.6-1

meridian-foundation-2022.1.7-1

meridian-foundation-2022.1.8-1

meridian-foundation-2022.1.9-1

meridian-foundation-2023.*

meridian-foundation-2023.1.0-1

meridian-foundation-2023.1.1-1

meridian-foundation-2023.1.2-1

meridian-foundation-2023.1.3-1

meridian-foundation-2023.1.4-1

meridian-foundation-2023.1.5-1

opennms-1.*

opennms-1.11.1-1

opennms-1.11.3-1

opennms-1.13.2-1

opennms-1.9.0-1

opennms-1.9.4-1

opennms-1.9.93-1

opennms-20.*

opennms-20.0.0-1

opennms-25.*

opennms-25.0.0-1

opennms-25.1.0-1

opennms-25.1.1-1

opennms-25.1.2-1

opennms-25.2.0-1

opennms-25.2.1-1

opennms-32.*

opennms-32.0.0-1

opennms-32.0.1-1

space-integration-12.*

space-integration-12.2-code-freeze

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "238717685826699779264405235825138348771",
                "273357828459484690270803841110896658284",
                "242177411191332957867788921979162704325",
                "179513327363497079895471805040185634015"
            ]
        },
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "id": "CVE-2023-40311-09622f97",
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "135521183293808262231671026994251354430",
            "length": 185.0
        },
        "target": {
            "function": "getFrameworkUrl",
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "id": "CVE-2023-40311-0e1088fe",
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40311.json"

vanir_signatures_modified

"2026-07-09T10:58:34Z"