OpenMNS Horizon vulnerabilities

OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 are vulnerable to XXE injection attacks in the file editor accessible to users with ROLE_FILESYSTEM_EDITOR privileges.

Multiple reflected XSS vulnerabilities were found in different JSP files in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 with unsanitized parameters. An attacker can modify these parameters to craft a malicious XSS payload.

Multiple stored XSS vulnerabilities were found in different JSP files in OpenMNS Horizon 31.0.8 and earlier versions up to 32.0.2 due to unsanitized parameters. An attacker can store malicious data in the database, which can then be loaded onto JSP or Angular templates.