{"id":"CVE-2023-0871","summary":"An XML External Entity injection vulnerability","details":"XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.\n","aliases":["GHSA-2qc8-r663-v864"],"modified":"2026-08-12T13:33:46.258205Z","published":"2023-08-11T16:13:50.714Z","database_specific":{"cna_assigner":"OpenNMS","cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0871.json"},"references":[{"type":"WEB","url":"https://docs.opennms.com/horizon/32/releasenotes/changelog.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0871.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0871"},{"type":"FIX","url":"https://github.com/OpenNMS/opennms/pull/6355"},{"type":"PACKAGE","url":"https://github.com/OpenNMS/opennms"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opennms/opennms","events":[{"introduced":"243216ffd4af348f1f416b62c954efea92dbd44d"},{"fixed":"5bbc4b368d0785d6d574713cb41c42c5a5f4421d"},{"introduced":"0"},{"fixed":"7d988a553d24fef53c503cedfe6a8436bf5cf69f"},{"fixed":"50bd3dd3d7158513132bbefbc26fc5f9e0a1a470"},{"fixed":"c7917e798bc6c70d01d87cd55d62541c8edefb29"},{"introduced":"2b771b66f9eeaf9b60dd3d8af2833d4bae66bf08"},{"fixed":"3b93e8f261edebe1857c34a0038b6ec03d5a7aa3"},{"introduced":"29913a2510b6a0a2d0ceff75540ee848a432aacd"},{"last_affected":"29913a2510b6a0a2d0ceff75540ee848a432aacd"}],"database_specific":{"cpe":["cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*","cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*","cpe:2.3:a:opennms:horizon:31.0.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"32.0.0"},{"fixed":"32.0.2"},{"introduced":"2020.0.0"},{"fixed":"2020.1.38"},{"introduced":"2021.0.0"},{"fixed":"2021.1.30"},{"introduced":"2023.0.0"},{"fixed":"2023.1.6"},{"introduced":"2022.1.0"},{"fixed":"2022.1.9"},{"introduced":"31.0.8"},{"last_affected":"31.0.8"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["31.0.8","meridian-foundation-2023.1.5-1","meridian-foundation-2020.1.37-1","meridian-foundation-2021.1.29-1","opennms-32.0.1-1","opennms-32.0.0-1","meridian-foundation-2021.1.28-1","meridian-foundation-2020.1.36-1","meridian-foundation-2023.1.4-1","opennms-31.0.8-1","meridian-foundation-2021.1.27-1","meridian-foundation-2020.1.35-1","meridian-foundation-2023.1.3-1","meridian-foundation-2021.1.26-1","meridian-foundation-2020.1.34-1","meridian-foundation-2023.1.2-1","meridian-foundation-2021.1.25-1","meridian-foundation-2020.1.33-1","meridian-foundation-2023.1.1-1","meridian-foundation-2021.1.24-1","meridian-foundation-2020.1.32-1","meridian-foundation-2023.1.0-1","meridian-foundation-2021.1.23-1","meridian-foundation-2020.1.31-1","meridian-foundation-2020.1.30-1","meridian-foundation-2021.1.22-1","opennms-31.0.1-1","meridian-foundation-2021.1.21-1","meridian-foundation-2020.1.29-1","opennms-31.0.0-1","meridian-foundation-2022.1.8-1","meridian-foundation-2021.1.20-1","meridian-foundation-2020.1.28-1","meridian-foundation-2021.1.19-1","meridian-foundation-2022.1.7-1","meridian-foundation-2020.1.27-1","meridian-foundation-2021.1.18-1","meridian-foundation-2020.1.26-1","meridian-foundation-2022.1.6-1","meridian-foundation-2021.1.17-1","meridian-foundation-2020.1.25-1","meridian-foundation-2022.1.5-1","meridian-foundation-2020.1.24-1","meridian-foundation-2022.1.4-1","meridian-foundation-2021.1.16-1","meridian-foundation-2020.1.23-1","meridian-foundation-2022.1.3-1","meridian-foundation-2021.1.15-1","meridian-foundation-2021.1.14-1","meridian-foundation-2022.1.2-1","meridian-foundation-2020.1.22-1","meridian-foundation-2020.1.21-1","meridian-foundation-2022.1.1-1","meridian-foundation-2021.1.12-1","meridian-foundation-2020.1.20-1","meridian-foundation-2022.1.0-1","meridian-foundation-2020.1.19-1","meridian-foundation-2021.1.11-1","meridian-foundation-2021.1.10-1","meridian-foundation-2020.1.18-1","meridian-foundation-2020.1.17-1","meridian-foundation-2021.1.9-1","meridian-foundation-2021.1.8-1","meridian-foundation-2020.1.16-1","meridian-foundation-2020.1.15-1","meridian-foundation-2021.1.7-1","meridian-foundation-2021.1.6-1","meridian-foundation-2020.1.14-1","meridian-foundation-2021.1.5-1","meridian-foundation-2020.1.13-1","meridian-foundation-2020.1.12-1","meridian-foundation-2020.1.11-1","meridian-foundation-2021.1.3-1","meridian-foundation-2020.1.10-1","meridian-foundation-2021.1.2-1","opennms-25.2.1-1","opennms-25.2.0-1","opennms-25.1.2-1","opennms-25.1.1-1","opennms-25.1.0-1","opennms-25.0.0-1","opennms-20.0.0-1","opennms-1.13.2-1","opennms-1.11.3-1","space-integration-12.2-code-freeze","opennms-1.11.1-1","opennms-1.9.93-1","opennms-1.9.4-1","opennms-1.9.0-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0871.json","vanir_signatures_modified":"2026-08-12T13:33:46Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["238717685826699779264405235825138348771","273357828459484690270803841110896658284","242177411191332957867788921979162704325","179513327363497079895471805040185634015"],"threshold":0.9},"id":"CVE-2023-0871-09622f97","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d","target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"}},{"target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java","function":"getFrameworkUrl"},"deprecated":false,"digest":{"function_hash":"135521183293808262231671026994251354430","length":185},"id":"CVE-2023-0871-0e1088fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L"}]}