Skip to main content

Cross-Site Request Forgery (CSRF)

CVE-2023-0870

Medium
6.7/10

Summary

A form can be manipulated with cross-site request forgery in OpenNMS Meridian versions prior to 2020.1.33, 2021.1.x prior to 2021.1.25, 2022.1.x prior to 2022.1.14, and 2023.1.x prior to 2023.1.1 and in Horizon prior to 31.0.6 versions are vulnerable. This can potentially allow an attacker to gain access to confidential information and compromise integrity. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

  • LOW
  • ADJACENT NETWORK
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • NONE

CWE-352 - Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is a vulnerability that allows an attacker to make arbitrary requests in an authenticated vulnerable web application and disrupt the integrity of the victim’s session. The impact of a successful CSRF attack may range from minor to severe, depending upon the capabilities exposed by the vulnerable application and privileges of the user. An attacker may force the user to perform state-changing requests like transferring funds, changing their email address or password etc. However, if an administrative level account is affected, it may compromise the whole web application and associated sensitive data.

References

Advisory Timeline

  • Published