An XML External Entity injection vulnerability
CVE-2023-0871

5.4MEDIUM

Key Information:

Vendor

The Opennms Group

Status
Horizon
Meridian
Vendor
CVE Published:
11 August 2023

What is CVE-2023-0871?

XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.

Affected Version(s)

Horizon Windows 31.0.8 < 32.0.2

Meridian Windows 2023.0.0 < 2023.1.6

Meridian Windows 2022.0.0 < 2022.1.19

References

https://github.com/OpenNMS/opennms/pull/6355
https://docs.opennms.com/horizon/32/releasenotes/changelo...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Moshe Apelbaum
Erik Wynter
.