PatchTheCVECVE-2023-0846: Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of Op
CVE-2023-0846 is a medium-severity flaw (CVSS 6.7) affecting horizon, meridian. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible f
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.7 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.5% (top 58%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-02-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-0846?
horizon: upgrade to 31.0.4; meridian: upgrade to 2023.1.0. Exact commands for each OS are on this page.
Is CVE-2023-0846 being exploited?
CVE-2023-0846 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-0846 affect?
CVE-2023-0846 affects horizon, meridian. Severity is medium (CVSS 6.7). Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 20
How urgent is CVE-2023-0846?
Priority 34/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-55748 MEDIUM 6.0 UPGRADE OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted pro
- CVE-2026-43002 MEDIUM 5.3 UPGRADE An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
- CVE-2023-40612 MEDIUM 5.3 UPGRADE UPGRADE In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user wi
- CVE-2023-40315 MEDIUM 5.3 UPGRADE UPGRADE In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has th
- CVE-2023-40314 MEDIUM 5.8 UPGRADE UPGRADE Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attack