CVE-2023-0869
Cross-site scripting in outage/list.htm
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.
Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-site scripting in outage/list.htm
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.
Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-0869- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-0658
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.
Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
EUVD-2023-0658- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7v39-jjj6-j4j4
Cross Site Scripting in OpenNMS
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information.
- Record
GHSA-7v39-jjj6-j4j4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.
Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-0869- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting in outage/list.htm
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer.
Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-0869- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSVGHSA-7v39-jjj6-j4j4
Cross Site Scripting in OpenNMS
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information.
- Record
GHSA-7v39-jjj6-j4j4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opennms:opennms-web-apiMaven |
through 31.0.3 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0869 is a medium vulnerability (CVSS 5.8) in Opennms Horizon, published February 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.