CVE-2023-0871 (GCVE-0-2023-0871)

Vulnerability from cvelistv5 – Published: 2023-08-11 16:13 – Updated: 2024-10-01 19:13
VLAI?
Summary
XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
CWE
  • CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
Vendor Product Version
The OpenNMS Group Horizon Affected: 31.0.8 , < 32.0.2 (maven)
Unknown: 0 , < 31.0.8 (maven)
Create a notification for this product.
    The OpenNMS Group Meridian Affected: 2023.0.0 , < 2023.1.6 (maven)
Affected: 2022.0.0 , < 2022.1.19 (maven)
Affected: 2021.0.0 , < 2021.1.30 (maven)
Affected: 2020.0.0 , < 2020.1.38 (maven)
Create a notification for this product.
Credits
Moshe Apelbaum Erik Wynter
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.671Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/OpenNMS/opennms/pull/6355"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.opennms.com/horizon/32/releasenotes/changelog.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T19:06:46.173797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T19:13:29.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Horizon",
          "repo": "https://github.com/OpenNMS/opennms",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "32.0.2",
              "status": "affected",
              "version": "31.0.8",
              "versionType": "maven"
            },
            {
              "lessThan": "31.0.8",
              "status": "unknown",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "product": "Meridian",
          "repo": "https://github.com/OpenNMS/opennms",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "2023.1.6",
              "status": "affected",
              "version": "2023.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2022.1.19",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2021.1.30",
              "status": "affected",
              "version": "2021.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2020.1.38",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Moshe Apelbaum"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Erik Wynter"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cstrong\u003eXXE injection\u003c/strong\u003e in \u003cstrong\u003e/rtc/post/ endpoint\u003c/strong\u003e in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms\u0026nbsp;is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services.\u0026nbsp;The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eOpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms\u00a0is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services.\u00a0The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u00a0OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-201",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-201 XML Entity Linking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL. Score based on the assumption that Horizon and Meridian are installed on internally protected networks and not exposed to the Internet, per installation instructions."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-22T18:29:33.329Z",
        "orgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
        "shortName": "OpenNMS"
      },
      "references": [
        {
          "url": "https://github.com/OpenNMS/opennms/pull/6355"
        },
        {
          "url": "https://docs.opennms.com/horizon/32/releasenotes/changelog.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer.\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer.\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "An XML External Entity injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
    "assignerShortName": "OpenNMS",
    "cveId": "CVE-2023-0871",
    "datePublished": "2023-08-11T16:13:50.714Z",
    "dateReserved": "2023-02-16T18:29:35.727Z",
    "dateUpdated": "2024-10-01T19:13:29.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"32.0.0\", \"versionEndExcluding\": \"32.0.2\", \"matchCriteriaId\": \"5E348236-BC02-4334-8F84-AC9F91C3D0AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:horizon:31.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CB86992A-06FF-4B7D-BFD3-FC04DFC96FBC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2020.0.0\", \"versionEndExcluding\": \"2020.1.38\", \"matchCriteriaId\": \"E6B9CB53-0A8C-4DB4-85E8-E0F81D6168AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2021.0.0\", \"versionEndExcluding\": \"2021.1.30\", \"matchCriteriaId\": \"BAB4DC97-9047-4302-90A0-4711AE93D364\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2022.1.0\", \"versionEndExcluding\": \"2022.1.9\", \"matchCriteriaId\": \"230DB641-455F-4F55-AFB2-1E6D974EE080\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2023.0.0\", \"versionEndExcluding\": \"2023.1.6\", \"matchCriteriaId\": \"9822AB30-2205-496D-952D-A0CFF409B72F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms\\u00a0is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services.\\u00a0The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\\u00a0OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.\\n\"}]",
      "id": "CVE-2023-0871",
      "lastModified": "2024-11-21T07:38:00.630",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@opennms.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}]}",
      "published": "2023-08-11T17:15:08.980",
      "references": "[{\"url\": \"https://docs.opennms.com/horizon/32/releasenotes/changelog.html\", \"source\": \"security@opennms.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/OpenNMS/opennms/pull/6355\", \"source\": \"security@opennms.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://docs.opennms.com/horizon/32/releasenotes/changelog.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/OpenNMS/opennms/pull/6355\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "security@opennms.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@opennms.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-611\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-611\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-0871\",\"sourceIdentifier\":\"security@opennms.com\",\"published\":\"2023-08-11T17:15:08.980\",\"lastModified\":\"2024-11-21T07:38:00.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms\u00a0is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services.\u00a0The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u00a0OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@opennms.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@opennms.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"32.0.0\",\"versionEndExcluding\":\"32.0.2\",\"matchCriteriaId\":\"5E348236-BC02-4334-8F84-AC9F91C3D0AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:horizon:31.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB86992A-06FF-4B7D-BFD3-FC04DFC96FBC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2020.0.0\",\"versionEndExcluding\":\"2020.1.38\",\"matchCriteriaId\":\"E6B9CB53-0A8C-4DB4-85E8-E0F81D6168AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.0.0\",\"versionEndExcluding\":\"2021.1.30\",\"matchCriteriaId\":\"BAB4DC97-9047-4302-90A0-4711AE93D364\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.1.0\",\"versionEndExcluding\":\"2022.1.9\",\"matchCriteriaId\":\"230DB641-455F-4F55-AFB2-1E6D974EE080\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2023.0.0\",\"versionEndExcluding\":\"2023.1.6\",\"matchCriteriaId\":\"9822AB30-2205-496D-952D-A0CFF409B72F\"}]}]}],\"references\":[{\"url\":\"https://docs.opennms.com/horizon/32/releasenotes/changelog.html\",\"source\":\"security@opennms.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/OpenNMS/opennms/pull/6355\",\"source\":\"security@opennms.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://docs.opennms.com/horizon/32/releasenotes/changelog.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/OpenNMS/opennms/pull/6355\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.