CVE-2023-40311
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Multiple stored XSS vulnerabilities were found in different JSP files in OpenMNS Horizon 31.0.8 and earlier versions up to 32.0.2 due to unsanitized parameters. An attacker can store malicious data in the database, which can then be loaded onto JSP or Angular templates.
Risk Assessment
These vulnerabilities can lead to user data theft and session hijacking, posing a serious threat to the organization's security.
Recommendation
It is recommended to upgrade to Meridian versions 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Additionally, Meridian and Horizon installations should be restricted to the organization's private networks and should not be directly accessible from the Internet.
Original NVD description (English source)
Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.