CVE-2023-0815

MEDIUM

Opennms Horizon < 31.0.4 - Log Information Exposure

Title source: rule

Description

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

References (2)

Core 2

Core References

Release Notes

https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13

Patch, Vendor Advisory

https://github.com/OpenNMS/opennms/pull/5741/files

Scores

CVSS v3 6.8

EPSS 0.0033

EPSS Percentile 55.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (3)

opennms/horizon < 31.0.4

opennms/meridian < 2023.1.0

org.opennms/opennms 0 - 31.0.4Maven

Published Feb 23, 2023

Tracked Since Feb 18, 2026