CVE-2023-0872

HIGH

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-0872 has a selected CVSS score of 8.2 (high); EIP currently links 1 catalogued exploit.

Description

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 3, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Horizon

Browse The OpenNMS Group / Horizon

Default status: unaffected

CVE List31.0.8 to < 32.0.2affected
Before 31.0.8unknown

Meridian

Browse The OpenNMS Group / Meridian

Default status: unaffected

CVE List2020.0.0 to ≤ 2020.1.37affected
2021.0.0 to ≤ 2021.1.29affected
2022.0.0 to ≤ 2022.1.18affected
2023.0.0 to ≤ 2023.1.5affected

org.opennms:opennms-webapp-rest

Browse Maven / org.opennms:opennms-webapp-rest
GitHub Advisory31.0.8 to < 32.0.2 · Fixed in 32.0.2affected

Proofs of concept

1

Catalogued exploits

MetasploitOpenNMS Horizon Authenticated RCEMetasploit exploitby Erik WynterNot analyzed1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details

References

5