CVE-2023-40313

low-risk

Published 2023-08-17

A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

ADJACENT_NETWORK / HIGH complexity

Affected Products (2)

Horizon

Meridian

Affected Vendors

Opennms

References (4)

Release Notes https://docs.opennms.com/horizon/32/releasenotes/changelog.html

Issue Tracking https://github.com/OpenNMS/opennms/pull/6368

Release Notes https://docs.opennms.com/horizon/32/releasenotes/changelog.html

Issue Tracking https://github.com/OpenNMS/opennms/pull/6368

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 7/34 · Low