CVE-2023-40612
Authenticated XXE Injection Via The File Editor
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Authenticated XXE Injection Via The File Editor
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-40612- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-91
- Updated
- 2026-11-02
EUVDEUVD-2023-45168
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
- Record
EUVD-2023-45168- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cjq5-2j3x-jvm9
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible...
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
- Record
GHSA-cjq5-2j3x-jvm9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-91
- Updated
- 2026-11-02
NVD
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-40612- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSV
Authenticated XXE Injection Via The File Editor
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
- Record
CVE-2023-40612- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-91
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40612 is a medium vulnerability (CVSS 5.3) in Opennms Horizon, published August 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.