Vulnerability Details CVE-2023-40312
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 36.7%
CVSS Severity
CVSS v3 Score 6.7
Products affected by CVE-2023-40312
-
cpe:2.3:a:opennms:horizon:31.0.8
-
cpe:2.3:a:opennms:horizon:31.0.9
-
cpe:2.3:a:opennms:horizon:32.0.0
-
cpe:2.3:a:opennms:horizon:32.0.1
-
cpe:2.3:a:opennms:meridian:2015.1.0
-
cpe:2.3:a:opennms:meridian:2015.1.0-1
-
cpe:2.3:a:opennms:meridian:2015.1.1-1
-
cpe:2.3:a:opennms:meridian:2015.1.10-1
-
cpe:2.3:a:opennms:meridian:2015.1.2-1
-
cpe:2.3:a:opennms:meridian:2015.1.3-1
-
cpe:2.3:a:opennms:meridian:2015.1.4-1
-
cpe:2.3:a:opennms:meridian:2015.1.5-1
-
cpe:2.3:a:opennms:meridian:2015.1.6-1
-
cpe:2.3:a:opennms:meridian:2015.1.7-1
-
cpe:2.3:a:opennms:meridian:2015.1.8-1
-
cpe:2.3:a:opennms:meridian:2015.1.9-1
-
cpe:2.3:a:opennms:meridian:2016.1.0
-
cpe:2.3:a:opennms:meridian:2016.1.1-1
-
cpe:2.3:a:opennms:meridian:2016.1.10-1
-
cpe:2.3:a:opennms:meridian:2016.1.11-1
-
cpe:2.3:a:opennms:meridian:2016.1.12-1
-
cpe:2.3:a:opennms:meridian:2016.1.13-1
-
cpe:2.3:a:opennms:meridian:2016.1.14-1
-
cpe:2.3:a:opennms:meridian:2016.1.15-1
-
cpe:2.3:a:opennms:meridian:2016.1.16-1
-
cpe:2.3:a:opennms:meridian:2016.1.17-1
-
cpe:2.3:a:opennms:meridian:2016.1.18-1
-
cpe:2.3:a:opennms:meridian:2016.1.19-1
-
cpe:2.3:a:opennms:meridian:2016.1.2-1
-
cpe:2.3:a:opennms:meridian:2016.1.20
-
cpe:2.3:a:opennms:meridian:2016.1.20-1
-
cpe:2.3:a:opennms:meridian:2016.1.21
-
cpe:2.3:a:opennms:meridian:2016.1.21-1
-
cpe:2.3:a:opennms:meridian:2016.1.22
-
cpe:2.3:a:opennms:meridian:2016.1.22-1
-
cpe:2.3:a:opennms:meridian:2016.1.23
-
cpe:2.3:a:opennms:meridian:2016.1.23-1
-
cpe:2.3:a:opennms:meridian:2016.1.24
-
cpe:2.3:a:opennms:meridian:2016.1.24-1
-
cpe:2.3:a:opennms:meridian:2016.1.3-1
-
cpe:2.3:a:opennms:meridian:2016.1.4-1
-
cpe:2.3:a:opennms:meridian:2016.1.5-1
-
cpe:2.3:a:opennms:meridian:2016.1.6-1
-
cpe:2.3:a:opennms:meridian:2016.1.7-1
-
cpe:2.3:a:opennms:meridian:2016.1.8-1
-
cpe:2.3:a:opennms:meridian:2016.1.9-1
-
cpe:2.3:a:opennms:meridian:2017
-
cpe:2.3:a:opennms:meridian:2017.1.0
-
cpe:2.3:a:opennms:meridian:2017.1.0-1
-
cpe:2.3:a:opennms:meridian:2017.1.1
-
cpe:2.3:a:opennms:meridian:2017.1.1-1
-
cpe:2.3:a:opennms:meridian:2017.1.10
-
cpe:2.3:a:opennms:meridian:2017.1.10-1
-
cpe:2.3:a:opennms:meridian:2017.1.11
-
cpe:2.3:a:opennms:meridian:2017.1.11-1
-
cpe:2.3:a:opennms:meridian:2017.1.12
-
cpe:2.3:a:opennms:meridian:2017.1.12-1
-
cpe:2.3:a:opennms:meridian:2017.1.13
-
cpe:2.3:a:opennms:meridian:2017.1.13-1
-
cpe:2.3:a:opennms:meridian:2017.1.14
-
cpe:2.3:a:opennms:meridian:2017.1.14-1
-
cpe:2.3:a:opennms:meridian:2017.1.15
-
cpe:2.3:a:opennms:meridian:2017.1.15-1
-
cpe:2.3:a:opennms:meridian:2017.1.16
-
cpe:2.3:a:opennms:meridian:2017.1.16-1
-
cpe:2.3:a:opennms:meridian:2017.1.17
-
cpe:2.3:a:opennms:meridian:2017.1.17-1
-
cpe:2.3:a:opennms:meridian:2017.1.18
-
cpe:2.3:a:opennms:meridian:2017.1.18-1
-
cpe:2.3:a:opennms:meridian:2017.1.19
-
cpe:2.3:a:opennms:meridian:2017.1.19-1
-
cpe:2.3:a:opennms:meridian:2017.1.2
-
cpe:2.3:a:opennms:meridian:2017.1.2-1
-
cpe:2.3:a:opennms:meridian:2017.1.20
-
cpe:2.3:a:opennms:meridian:2017.1.20-1
-
cpe:2.3:a:opennms:meridian:2017.1.21
-
cpe:2.3:a:opennms:meridian:2017.1.21-1
-
cpe:2.3:a:opennms:meridian:2017.1.22
-
cpe:2.3:a:opennms:meridian:2017.1.22-1
-
cpe:2.3:a:opennms:meridian:2017.1.23
-
cpe:2.3:a:opennms:meridian:2017.1.23-1
-
cpe:2.3:a:opennms:meridian:2017.1.24
-
cpe:2.3:a:opennms:meridian:2017.1.24-1
-
cpe:2.3:a:opennms:meridian:2017.1.25
-
cpe:2.3:a:opennms:meridian:2017.1.25-1
-
cpe:2.3:a:opennms:meridian:2017.1.26
-
cpe:2.3:a:opennms:meridian:2017.1.26-1
-
cpe:2.3:a:opennms:meridian:2017.1.3
-
cpe:2.3:a:opennms:meridian:2017.1.3-1
-
cpe:2.3:a:opennms:meridian:2017.1.4
-
cpe:2.3:a:opennms:meridian:2017.1.4-1
-
cpe:2.3:a:opennms:meridian:2017.1.5
-
cpe:2.3:a:opennms:meridian:2017.1.5-1
-
cpe:2.3:a:opennms:meridian:2017.1.6
-
cpe:2.3:a:opennms:meridian:2017.1.6-1
-
cpe:2.3:a:opennms:meridian:2017.1.7
-
cpe:2.3:a:opennms:meridian:2017.1.7-1
-
cpe:2.3:a:opennms:meridian:2017.1.8
-
cpe:2.3:a:opennms:meridian:2017.1.8-1
-
cpe:2.3:a:opennms:meridian:2017.1.9
-
cpe:2.3:a:opennms:meridian:2017.1.9-1
-
cpe:2.3:a:opennms:meridian:2018
-
cpe:2.3:a:opennms:meridian:2018.1.0
-
cpe:2.3:a:opennms:meridian:2018.1.0-1
-
cpe:2.3:a:opennms:meridian:2018.1.1
-
cpe:2.3:a:opennms:meridian:2018.1.1-1
-
cpe:2.3:a:opennms:meridian:2018.1.10
-
cpe:2.3:a:opennms:meridian:2018.1.10-1
-
cpe:2.3:a:opennms:meridian:2018.1.11
-
cpe:2.3:a:opennms:meridian:2018.1.11-1
-
cpe:2.3:a:opennms:meridian:2018.1.12
-
cpe:2.3:a:opennms:meridian:2018.1.12-1
-
cpe:2.3:a:opennms:meridian:2018.1.13
-
cpe:2.3:a:opennms:meridian:2018.1.13-1
-
cpe:2.3:a:opennms:meridian:2018.1.14
-
cpe:2.3:a:opennms:meridian:2018.1.14-1
-
cpe:2.3:a:opennms:meridian:2018.1.15
-
cpe:2.3:a:opennms:meridian:2018.1.15-1
-
cpe:2.3:a:opennms:meridian:2018.1.16
-
cpe:2.3:a:opennms:meridian:2018.1.16-1
-
cpe:2.3:a:opennms:meridian:2018.1.17
-
cpe:2.3:a:opennms:meridian:2018.1.17-1
-
cpe:2.3:a:opennms:meridian:2018.1.18
-
cpe:2.3:a:opennms:meridian:2018.1.18-1
-
cpe:2.3:a:opennms:meridian:2018.1.19
-
cpe:2.3:a:opennms:meridian:2018.1.19-1
-
cpe:2.3:a:opennms:meridian:2018.1.2
-
cpe:2.3:a:opennms:meridian:2018.1.2-1
-
cpe:2.3:a:opennms:meridian:2018.1.20
-
cpe:2.3:a:opennms:meridian:2018.1.20-1
-
cpe:2.3:a:opennms:meridian:2018.1.21
-
cpe:2.3:a:opennms:meridian:2018.1.21-1
-
cpe:2.3:a:opennms:meridian:2018.1.22
-
cpe:2.3:a:opennms:meridian:2018.1.22-1
-
cpe:2.3:a:opennms:meridian:2018.1.23
-
cpe:2.3:a:opennms:meridian:2018.1.23-1
-
cpe:2.3:a:opennms:meridian:2018.1.24
-
cpe:2.3:a:opennms:meridian:2018.1.24-1
-
cpe:2.3:a:opennms:meridian:2018.1.25
-
cpe:2.3:a:opennms:meridian:2018.1.25-1
-
cpe:2.3:a:opennms:meridian:2018.1.26
-
cpe:2.3:a:opennms:meridian:2018.1.26-1
-
cpe:2.3:a:opennms:meridian:2018.1.27
-
cpe:2.3:a:opennms:meridian:2018.1.27-1
-
cpe:2.3:a:opennms:meridian:2018.1.28
-
cpe:2.3:a:opennms:meridian:2018.1.28-1
-
cpe:2.3:a:opennms:meridian:2018.1.29
-
cpe:2.3:a:opennms:meridian:2018.1.29-1
-
cpe:2.3:a:opennms:meridian:2018.1.3
-
cpe:2.3:a:opennms:meridian:2018.1.3-1
-
cpe:2.3:a:opennms:meridian:2018.1.30
-
cpe:2.3:a:opennms:meridian:2018.1.31
-
cpe:2.3:a:opennms:meridian:2018.1.4
-
cpe:2.3:a:opennms:meridian:2018.1.4-1
-
cpe:2.3:a:opennms:meridian:2018.1.5
-
cpe:2.3:a:opennms:meridian:2018.1.5-1
-
cpe:2.3:a:opennms:meridian:2018.1.6
-
cpe:2.3:a:opennms:meridian:2018.1.6-1
-
cpe:2.3:a:opennms:meridian:2018.1.7
-
cpe:2.3:a:opennms:meridian:2018.1.7-1
-
cpe:2.3:a:opennms:meridian:2018.1.8
-
cpe:2.3:a:opennms:meridian:2018.1.8-1
-
cpe:2.3:a:opennms:meridian:2018.1.9
-
cpe:2.3:a:opennms:meridian:2018.1.9-1
-
cpe:2.3:a:opennms:meridian:2019
-
cpe:2.3:a:opennms:meridian:2019.1.0
-
cpe:2.3:a:opennms:meridian:2019.1.0-1
-
cpe:2.3:a:opennms:meridian:2019.1.1
-
cpe:2.3:a:opennms:meridian:2019.1.1-1
-
cpe:2.3:a:opennms:meridian:2019.1.10
-
cpe:2.3:a:opennms:meridian:2019.1.10-1
-
cpe:2.3:a:opennms:meridian:2019.1.11
-
cpe:2.3:a:opennms:meridian:2019.1.11-1
-
cpe:2.3:a:opennms:meridian:2019.1.12
-
cpe:2.3:a:opennms:meridian:2019.1.12-1
-
cpe:2.3:a:opennms:meridian:2019.1.13
-
cpe:2.3:a:opennms:meridian:2019.1.13-1
-
cpe:2.3:a:opennms:meridian:2019.1.14
-
cpe:2.3:a:opennms:meridian:2019.1.14-1
-
cpe:2.3:a:opennms:meridian:2019.1.15
-
cpe:2.3:a:opennms:meridian:2019.1.15-1
-
cpe:2.3:a:opennms:meridian:2019.1.16
-
cpe:2.3:a:opennms:meridian:2019.1.16-1
-
cpe:2.3:a:opennms:meridian:2019.1.17
-
cpe:2.3:a:opennms:meridian:2019.1.17-1
-
cpe:2.3:a:opennms:meridian:2019.1.18
-
cpe:2.3:a:opennms:meridian:2019.1.18-1
-
cpe:2.3:a:opennms:meridian:2019.1.19
-
cpe:2.3:a:opennms:meridian:2019.1.19-1
-
cpe:2.3:a:opennms:meridian:2019.1.2
-
cpe:2.3:a:opennms:meridian:2019.1.2-1
-
cpe:2.3:a:opennms:meridian:2019.1.20
-
cpe:2.3:a:opennms:meridian:2019.1.20-1
-
cpe:2.3:a:opennms:meridian:2019.1.21
-
cpe:2.3:a:opennms:meridian:2019.1.22
-
cpe:2.3:a:opennms:meridian:2019.1.23
-
cpe:2.3:a:opennms:meridian:2019.1.24
-
cpe:2.3:a:opennms:meridian:2019.1.25
-
cpe:2.3:a:opennms:meridian:2019.1.26
-
cpe:2.3:a:opennms:meridian:2019.1.27
-
cpe:2.3:a:opennms:meridian:2019.1.28
-
cpe:2.3:a:opennms:meridian:2019.1.29
-
cpe:2.3:a:opennms:meridian:2019.1.3
-
cpe:2.3:a:opennms:meridian:2019.1.3-1
-
cpe:2.3:a:opennms:meridian:2019.1.30
-
cpe:2.3:a:opennms:meridian:2019.1.31
-
cpe:2.3:a:opennms:meridian:2019.1.32
-
cpe:2.3:a:opennms:meridian:2019.1.33
-
cpe:2.3:a:opennms:meridian:2019.1.34
-
cpe:2.3:a:opennms:meridian:2019.1.35
-
cpe:2.3:a:opennms:meridian:2019.1.36
-
cpe:2.3:a:opennms:meridian:2019.1.37
-
cpe:2.3:a:opennms:meridian:2019.1.38
-
cpe:2.3:a:opennms:meridian:2019.1.39
-
cpe:2.3:a:opennms:meridian:2019.1.4
-
cpe:2.3:a:opennms:meridian:2019.1.4-1
-
cpe:2.3:a:opennms:meridian:2019.1.40
-
cpe:2.3:a:opennms:meridian:2019.1.5
-
cpe:2.3:a:opennms:meridian:2019.1.5-1
-
cpe:2.3:a:opennms:meridian:2019.1.6
-
cpe:2.3:a:opennms:meridian:2019.1.6-1
-
cpe:2.3:a:opennms:meridian:2019.1.7
-
cpe:2.3:a:opennms:meridian:2019.1.7-1
-
cpe:2.3:a:opennms:meridian:2019.1.8
-
cpe:2.3:a:opennms:meridian:2019.1.8-1
-
cpe:2.3:a:opennms:meridian:2019.1.9
-
cpe:2.3:a:opennms:meridian:2020.1.0
-
cpe:2.3:a:opennms:meridian:2020.1.1
-
cpe:2.3:a:opennms:meridian:2020.1.1-1
-
cpe:2.3:a:opennms:meridian:2020.1.10
-
cpe:2.3:a:opennms:meridian:2020.1.11
-
cpe:2.3:a:opennms:meridian:2020.1.12
-
cpe:2.3:a:opennms:meridian:2020.1.13
-
cpe:2.3:a:opennms:meridian:2020.1.14
-
cpe:2.3:a:opennms:meridian:2020.1.15
-
cpe:2.3:a:opennms:meridian:2020.1.16
-
cpe:2.3:a:opennms:meridian:2020.1.17
-
cpe:2.3:a:opennms:meridian:2020.1.18
-
cpe:2.3:a:opennms:meridian:2020.1.19
-
cpe:2.3:a:opennms:meridian:2020.1.2
-
cpe:2.3:a:opennms:meridian:2020.1.2-1
-
cpe:2.3:a:opennms:meridian:2020.1.20
-
cpe:2.3:a:opennms:meridian:2020.1.21
-
cpe:2.3:a:opennms:meridian:2020.1.22
-
cpe:2.3:a:opennms:meridian:2020.1.23
-
cpe:2.3:a:opennms:meridian:2020.1.24
-
cpe:2.3:a:opennms:meridian:2020.1.25
-
cpe:2.3:a:opennms:meridian:2020.1.26
-
cpe:2.3:a:opennms:meridian:2020.1.27
-
cpe:2.3:a:opennms:meridian:2020.1.28
-
cpe:2.3:a:opennms:meridian:2020.1.29
-
cpe:2.3:a:opennms:meridian:2020.1.3
-
cpe:2.3:a:opennms:meridian:2020.1.3-1
-
cpe:2.3:a:opennms:meridian:2020.1.30
-
cpe:2.3:a:opennms:meridian:2020.1.31
-
cpe:2.3:a:opennms:meridian:2020.1.32
-
cpe:2.3:a:opennms:meridian:2020.1.33
-
cpe:2.3:a:opennms:meridian:2020.1.34
-
cpe:2.3:a:opennms:meridian:2020.1.35
-
cpe:2.3:a:opennms:meridian:2020.1.36
-
cpe:2.3:a:opennms:meridian:2020.1.37
-
cpe:2.3:a:opennms:meridian:2020.1.4
-
cpe:2.3:a:opennms:meridian:2020.1.4-1
-
cpe:2.3:a:opennms:meridian:2020.1.5
-
cpe:2.3:a:opennms:meridian:2020.1.5-1
-
cpe:2.3:a:opennms:meridian:2020.1.6
-
cpe:2.3:a:opennms:meridian:2020.1.7
-
cpe:2.3:a:opennms:meridian:2020.1.7-1
-
cpe:2.3:a:opennms:meridian:2020.1.8
-
cpe:2.3:a:opennms:meridian:2020.1.8-1
-
cpe:2.3:a:opennms:meridian:2020.1.9
-
cpe:2.3:a:opennms:meridian:2020.1.9-1
-
cpe:2.3:a:opennms:meridian:2022.1.0
-
cpe:2.3:a:opennms:meridian:2022.1.1
-
cpe:2.3:a:opennms:meridian:2022.1.10
-
cpe:2.3:a:opennms:meridian:2022.1.11
-
cpe:2.3:a:opennms:meridian:2022.1.12
-
cpe:2.3:a:opennms:meridian:2022.1.13
-
cpe:2.3:a:opennms:meridian:2022.1.14
-
cpe:2.3:a:opennms:meridian:2022.1.15
-
cpe:2.3:a:opennms:meridian:2022.1.16
-
cpe:2.3:a:opennms:meridian:2022.1.17
-
cpe:2.3:a:opennms:meridian:2022.1.18
-
cpe:2.3:a:opennms:meridian:2022.1.2
-
cpe:2.3:a:opennms:meridian:2022.1.3
-
cpe:2.3:a:opennms:meridian:2022.1.4
-
cpe:2.3:a:opennms:meridian:2022.1.5
-
cpe:2.3:a:opennms:meridian:2022.1.6
-
cpe:2.3:a:opennms:meridian:2022.1.7
-
cpe:2.3:a:opennms:meridian:2022.1.8
-
cpe:2.3:a:opennms:meridian:2022.1.9
-
cpe:2.3:a:opennms:meridian:2023.1.0
-
cpe:2.3:a:opennms:meridian:2023.1.1
-
cpe:2.3:a:opennms:meridian:2023.1.2
-
cpe:2.3:a:opennms:meridian:2023.1.3
-
cpe:2.3:a:opennms:meridian:2023.1.4
-
cpe:2.3:a:opennms:meridian:2023.1.5