Moderate severityNVD Advisory· Published Aug 17, 2023· Updated Oct 28, 2024

ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN

CVE-2023-40315

Description

In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.opennms:opennms-webapp-restMaven	>= 31.0.8, < 32.0.2	32.0.2

Affected products

ghsa-coords
pkg:maven/org.opennms/opennms-webapp-rest
Range: >= 31.0.8, < 32.0.2
The OpenNMS Group/Horizonv5
Range: 31.0.8
The OpenNMS Group/Meridianv5
Range: 2023.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hf5p-f83x-5q2gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-40315ghsaADVISORY
docs.opennms.com/meridian/2023/releasenotes/changelog.htmlghsaWEB
github.com/OpenNMS/opennms/commit/f2caf7d0b9db58b59e98506490aaca37fbf243b6ghsaWEB
github.com/OpenNMS/opennms/pull/6250ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.002
exploit	0.030
kev	0.000
patch	-0.070
ransomware	0.000