medium6.5
CVE-2023-0815
OpenNMS has potential Insertion of Sensitive Information into Log File vulnerability
Impact
Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.opennms:opennms | < 31.0.4 | 31.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opennms | Horizon | before 31.0.4 |
| Opennms | Meridian | before 2023.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
- https://github.com/OpenNMS/opennms/pull/5741/files
- https://github.com/advisories/GHSA-9xpj-mvp2-3943
- https://nvd.nist.gov/vuln/detail/CVE-2023-0815
- https://github.com/OpenNMS/opennms/releases/tag/opennms-31.0.4-1