CVE-2023-40312
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Multiple reflected XSS vulnerabilities were found in different JSP files in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 with unsanitized parameters. An attacker can modify these parameters to craft a malicious XSS payload.
Risk Assessment
This vulnerability may allow the execution of malicious code in users' browsers, potentially leading to data theft or session hijacking. Organizations should be aware of the risks associated with accessing these applications from the Internet.
Recommendation
It is recommended to upgrade to Meridian versions 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Additionally, applications should be installed within the organization's private networks and should not be directly accessible from the Internet.
Original NVD description (English source)
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.