{"id":"CVE-2023-40313","summary":"Disable BeanShell Interpreter Remote Server Mode","details":"A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.","aliases":["GHSA-5m5f-qg8r-p9qf"],"modified":"2026-08-12T14:50:56.854686Z","published":"2023-08-17T18:24:08.866Z","database_specific":{"cna_assigner":"OpenNMS","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40313.json"},"references":[{"type":"WEB","url":"https://docs.opennms.com/horizon/32/releasenotes/changelog.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40313.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40313"},{"type":"FIX","url":"https://github.com/OpenNMS/opennms/pull/6368"},{"type":"PACKAGE","url":"https://github.com/OpenNMS/opennms"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opennms/opennms","events":[{"introduced":"0"},{"fixed":"5bbc4b368d0785d6d574713cb41c42c5a5f4421d"},{"fixed":"7d988a553d24fef53c503cedfe6a8436bf5cf69f"},{"introduced":"85e3e796e0953e602941e8fcd6ccaab36f00cacb"},{"fixed":"50bd3dd3d7158513132bbefbc26fc5f9e0a1a470"},{"introduced":"2b771b66f9eeaf9b60dd3d8af2833d4bae66bf08"},{"fixed":"2c624fc642309b2f7b7e0bf560be284283bf267e"},{"introduced":"3619e2c44a6e3efe312f8f7f46a9d06955e01bb0"},{"fixed":"c7917e798bc6c70d01d87cd55d62541c8edefb29"}],"database_specific":{"source":"CPE_RANGE","cpe":["cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*","cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"32.0.2"},{"fixed":"2020.1.38"},{"introduced":"2021.1.0"},{"fixed":"2021.1.30"},{"introduced":"2022.1.0"},{"fixed":"2022.1.19"},{"introduced":"2023.1.0"},{"fixed":"2023.1.6"}]}}],"versions":["meridian-foundation-2023.1.5-1","meridian-foundation-2020.1.37-1","meridian-foundation-2021.1.29-1","opennms-32.0.1-1","meridian-foundation-2022.1.18-1","opennms-32.0.0-1","meridian-foundation-2022.1.17-1","meridian-foundation-2021.1.28-1","meridian-foundation-2020.1.36-1","meridian-foundation-2023.1.4-1","meridian-foundation-2021.1.27-1","meridian-foundation-2020.1.35-1","meridian-foundation-2022.1.16-1","meridian-foundation-2023.1.3-1","meridian-foundation-2022.1.15-1","meridian-foundation-2021.1.26-1","meridian-foundation-2020.1.34-1","meridian-foundation-2023.1.2-1","meridian-foundation-2022.1.14-1","meridian-foundation-2021.1.25-1","meridian-foundation-2020.1.33-1","meridian-foundation-2023.1.1-1","meridian-foundation-2021.1.24-1","meridian-foundation-2020.1.32-1","meridian-foundation-2023.1.0-1","meridian-foundation-2022.1.13-1","meridian-foundation-2022.1.12-1","meridian-foundation-2021.1.23-1","meridian-foundation-2020.1.31-1","meridian-foundation-2022.1.11-1","meridian-foundation-2020.1.30-1","meridian-foundation-2021.1.22-1","meridian-foundation-2022.1.10-1","meridian-foundation-2022.1.9-1","meridian-foundation-2021.1.21-1","meridian-foundation-2020.1.29-1","meridian-foundation-2022.1.8-1","meridian-foundation-2021.1.20-1","meridian-foundation-2020.1.28-1","meridian-foundation-2021.1.19-1","meridian-foundation-2022.1.7-1","meridian-foundation-2020.1.27-1","meridian-foundation-2021.1.18-1","meridian-foundation-2020.1.26-1","meridian-foundation-2022.1.6-1","meridian-foundation-2021.1.17-1","meridian-foundation-2020.1.25-1","meridian-foundation-2022.1.5-1","meridian-foundation-2020.1.24-1","meridian-foundation-2022.1.4-1","meridian-foundation-2021.1.16-1","meridian-foundation-2020.1.23-1","meridian-foundation-2022.1.3-1","meridian-foundation-2021.1.15-1","meridian-foundation-2021.1.14-1","meridian-foundation-2022.1.2-1","meridian-foundation-2020.1.22-1","meridian-foundation-2020.1.21-1","meridian-foundation-2022.1.1-1","meridian-foundation-2021.1.12-1","meridian-foundation-2020.1.20-1","meridian-foundation-2022.1.0-1","meridian-foundation-2020.1.19-1","meridian-foundation-2021.1.11-1","meridian-foundation-2021.1.10-1","meridian-foundation-2020.1.18-1","meridian-foundation-2020.1.17-1","meridian-foundation-2021.1.9-1","meridian-foundation-2021.1.8-1","meridian-foundation-2020.1.16-1","meridian-foundation-2020.1.15-1","meridian-foundation-2021.1.7-1","meridian-foundation-2021.1.6-1","meridian-foundation-2020.1.14-1","meridian-foundation-2021.1.5-1","meridian-foundation-2020.1.13-1","meridian-foundation-2020.1.12-1","meridian-foundation-2020.1.11-1","meridian-foundation-2021.1.3-1","meridian-foundation-2020.1.10-1","meridian-foundation-2021.1.2-1","opennms-25.2.1-1","opennms-25.2.0-1","opennms-25.1.2-1","opennms-25.1.1-1","opennms-25.1.0-1","opennms-25.0.0-1","opennms-20.0.0-1","opennms-1.13.2-1","opennms-1.11.3-1","space-integration-12.2-code-freeze","opennms-1.11.1-1","opennms-1.9.93-1","opennms-1.9.4-1","opennms-1.9.0-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40313.json","vanir_signatures_modified":"2026-08-12T14:50:56Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d","target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"},"deprecated":false,"digest":{"line_hashes":["238717685826699779264405235825138348771","273357828459484690270803841110896658284","242177411191332957867788921979162704325","179513327363497079895471805040185634015"],"threshold":0.9},"id":"CVE-2023-40313-09622f97","signature_type":"Line"},{"target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java","function":"getFrameworkUrl"},"deprecated":false,"digest":{"function_hash":"135521183293808262231671026994251354430","length":185},"id":"CVE-2023-40313-0e1088fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/5bbc4b368d0785d6d574713cb41c42c5a5f4421d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}]}