CVE-2023-30093

ONOS vulnerable to Cross-site Scripting

6.1 Medium

A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.49%Up 0.4 points since May 5, 2023

What each source reports

NVD Score used 6.1

Record: CVE-2023-30093
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 6.1

Record: CVE-2023-30093
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-1607 6.1

Record: EUVD-2023-1607
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q63q-hwf6-3mw6 6.1

ONOS vulnerable to Cross-site Scripting

A cross-site scripting (XSS) vulnerability in Open Network Operating System (ONOS) from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the authorizationURL parameter of the API documentation dashboard under securityDefinitions > OAuth2 > authorizationURL.

Record: GHSA-q63q-hwf6-3mw6
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Record: CVE-2023-30093
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-q63q-hwf6-3mw6 6.1

ONOS vulnerable to Cross-site Scripting

Record: GHSA-q63q-hwf6-3mw6
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

onosproject onos

Affected packages

Affected packages
Package	Affected	Fixed
`org.onosproject:onos-archetypes` Maven	1.9.0 to 2.7.0	None known
`org.onosproject:onos-archetypes` Maven	1.9.0 to 2.7.0, plus listed versions 1.10.01.10.0-rc11.10.0-rc21.10.0-rc31.10.0-rc4 Show 45 moreShow less 1.10.0-rc51.10.11.10.101.10.111.10.121.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0-b21.11.0-b31.11.0-b41.11.0-rc41.11.0-rc51.11.0-rc61.11.11.11.1-rc11.11.21.11.2-rc11.11.2-rc31.11.2-rc41.11.2-rc51.11.2-rc61.12.01.12.0-b11.12.0-b21.12.0-rc11.12.0-rc21.12.0-rc31.12.11.12.1-rc11.12.1-rc21.12.1-rc61.12.1-rc71.12.2-rc21.13.01.13.0-b51.13.0-b61.13.0-b81.13.1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30093 is a medium vulnerability (CVSS 6.1) in Onosproject Onos, published May 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 89 versions. The JSON record has them.