CVE-2023-0872
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-0872- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2023-2369
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
EUVD-2023-2369- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w5gq-xrrp-3fxf
OpenNMS privilege elevation vulnerability
The Horizon REST API includes a users endpoint in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
GHSA-w5gq-xrrp-3fxf- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-0872- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-0872- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVGHSA-w5gq-xrrp-3fxf
OpenNMS privilege elevation vulnerability
The Horizon REST API includes a users endpoint in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
- Record
GHSA-w5gq-xrrp-3fxf- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opennms:opennms-webapp-restMaven |
31.0.8 up to 32.0.2 | 32.0.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | OpenNMS Horizon Authenticated RCE | 2023-07-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0872 is a high vulnerability (CVSS 8.2) in Opennms Horizon, published August 14, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. Fixed in org.opennms:opennms-webapp-rest 32.0.2.
References
docs.opennms.com/horizon/32/releasenotes/changelog.html
github.com/OpenNMS/opennms/pull/6354
nvd.nist.gov/vuln/detail/CVE-2023-0872