What is GHSA-c6xw-hg9q-3c9f?

GHSA-c6xw-hg9q-3c9f is a security advisory published by GitHub Security Advisories with Medium severity. OpenNMS Cross-site Scripting vulnerability

Which CVE IDs does GHSA-c6xw-hg9q-3c9f cover?

GHSA-c6xw-hg9q-3c9f covers the following CVE IDs: CVE-2023-40314. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c6xw-hg9q-3c9f?

GHSA-c6xw-hg9q-3c9f has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c6xw-hg9q-3c9f?

GHSA-c6xw-hg9q-3c9f affects 1 product, including: maven/org.opennms:opennms-webapp:\u003c 32.0.5.

GHSA-c6xw-hg9q-3c9fMediumCVSS 5.8

OpenNMS Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

November 17, 2023

Last Modified

November 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-40314 →

📋 Description

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer.

Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

🎯 Affected products1

maven/org.opennms:opennms-webapp:< 32.0.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-40314
https://github.com/OpenNMS/opennms/pull/6791
https://opennms.atlassian.net/browse/NMS-15790
https://github.com/advisories/GHSA-c6xw-hg9q-3c9f