PatchTheCVEmeridian vulnerabilities and fixes
Recent CVEs affecting meridian, with upgrade or downgrade steps. 15 tracked.
meridian has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2023-11-16. Highest priority: CVE-2023-0872 (score 56/100).
- CVE-2023-40612 MEDIUM 5.3 UPGRADE UPGRADE In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user wi
- CVE-2023-40315 MEDIUM 5.3 UPGRADE UPGRADE In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has th
- CVE-2023-40314 MEDIUM 5.8 UPGRADE UPGRADE Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attack
- CVE-2023-40313 HIGH 7.1 UPGRADE UPGRADE A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in rela
- CVE-2023-40312 MEDIUM 6.7 UPGRADE UPGRADE Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8
- CVE-2023-40311 MEDIUM 6.7 UPGRADE UPGRADE Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 an
- CVE-2023-0872 HIGH 8.2 UPGRADE UPGRADE The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on m
- CVE-2023-0871 MEDIUM 5.4 UPGRADE UPGRADE XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple pl
- CVE-2023-0870 HIGH 8.1 UPGRADE UPGRADE A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon
- CVE-2023-0869 MEDIUM 5.8 UPGRADE UPGRADE Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacke
- CVE-2023-0868 MEDIUM 6.7 UPGRADE UPGRADE Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could all
- CVE-2023-0867 MEDIUM 6.7 UPGRADE UPGRADE Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of
- CVE-2023-0846 MEDIUM 6.7 UPGRADE UPGRADE Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of Op
- CVE-2023-0815 MEDIUM 6.8 UPGRADE UPGRADE Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and
- CVE-2022-29578 MEDIUM 5.3 DOWNGRADE Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive inf
FAQ
How do I fix meridian vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is meridian being exploited right now?
None of the tracked meridian CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which meridian CVE should I patch first?
CVE-2023-0872 currently ranks highest (56/100): The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on m.