CVE-2023-40313

HighCVSS 7.1

Published: 17/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.70%

48th percentile - higher than 48% of all known CVEs

Summary

A BeanShell interpreter in remote server mode in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer.

Risk Assessment

Exploitation of this vulnerability could lead to remote code execution, posing a serious security risk to the organization.

Recommendation

It is recommended to immediately upgrade to the latest versions of Meridian or Horizon and ensure that installations are only accessible within the organization's private networks.

Other vulnerabilities in OpenMNS Horizon, Meridian

CVE-2023-40315Medium
In OpenMNS Horizon version 31.0.8 and earlier than 32.0.2, users with the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. This issue also affects related Meridian versions.

Original NVD description (English source)

A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS