CVE-2023-40612

CVSS V2 None CVSS V3 None
Description
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
Overview
  • CVE ID
  • CVE-2023-40612
  • Assigner
  • OpenNMS
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-08-23T18:22:49.025Z
  • Last Modified Date
  • 2023-08-23T18:35:01.032Z
Weakness Enumerations
CWE URL
CWE-91 http://cwe.mitre.org/data/definitions/91.html
References
Reference URL Reference Tags
https://github.com/OpenNMS/opennms/pull/6288
https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.5
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-40612
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40612
History
Created Old Value New Value Data Type Notes
2024-06-25 01:56:58 Added to TrackCVE