CVE-2023-40313
Disable BeanShell Interpreter Remote Server Mode
CVE-2023-40313 is a high vulnerability (CVSS 7.1) in Opennms Horizon, published August 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in org.opennms:opennms-base-assembly 32.0.2.
- Severity
- 7.1 HighCVSS 3.1, CVE List
- Exploit chance
- 0.78%EPSS, 56th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
32.0.2org.opennms:opennms-base-assembly
Description
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opennms:opennms-base-assemblyMaven | before 32.0.2 | 32.0.2 |
What each source reports
CVE List Score used
Disable BeanShell Interpreter Remote Server Mode
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-40313- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-2214
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
EUVD-2023-2214- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5m5f-qg8r-p9qf
OpenNMS vulnerable to remote code execution
A BeanShell interpreter in remote server mode runs in OpenNMS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
GHSA-5m5f-qg8r-p9qf- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-40313- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Disable BeanShell Interpreter Remote Server Mode
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
CVE-2023-40313- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVGHSA-5m5f-qg8r-p9qf
OpenNMS vulnerable to remote code execution
A BeanShell interpreter in remote server mode runs in OpenNMS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Record
GHSA-5m5f-qg8r-p9qf- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
docs.opennms.com/horizon/32/releasenotes/changelog.html
github.com/OpenNMS/opennms/pull/6368
nvd.nist.gov/vuln/detail/CVE-2023-40313