CVSS 6.1 · Medium EPSS 0,55%
Kerentanan Improper Restriction of XML External Entity Reference pada opennms horizon, opennms meridian. Skor CVSS 3.1 6.1 (Medium) menurut NVD.
XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| opennms | horizon | Versi 32.0.0 hingga sebelum 32.0.2 |
| opennms | horizon | Versi 31.0.8 |
| opennms | meridian | Versi 2020.0.0 hingga sebelum 2020.1.38 |
| opennms | meridian | Versi 2021.0.0 hingga sebelum 2021.1.30 |
| opennms | meridian | Versi 2022.1.0 hingga sebelum 2022.1.9 |
| opennms | meridian | Versi 2023.0.0 hingga sebelum 2023.1.6 |