Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.opennms/opennms-webapp@31.0.8
Typemaven
Namespaceorg.opennms
Nameopennms-webapp
Version31.0.8
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version31.0.4
Latest_non_vulnerable_version32.0.5
Affected_by_vulnerabilities
0
url VCID-hsec-2xnv-4qaa
vulnerability_id VCID-hsec-2xnv-4qaa
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-40311
reference_id
reference_type
scores
0
value 0.00148
scoring_system epss
scoring_elements 0.34974
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-40311
1
reference_url https://github.com/OpenNMS/opennms
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T21:49:38Z/
url https://github.com/OpenNMS/opennms
2
reference_url https://github.com/OpenNMS/opennms/commit/6ccc5de1a23d440560e0f09dfd94f8392c21e70d
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/OpenNMS/opennms/commit/6ccc5de1a23d440560e0f09dfd94f8392c21e70d
3
reference_url https://github.com/OpenNMS/opennms/commit/c67d1cae2fa1fb806c9d422f6e6fbf4ebfde6b60
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/OpenNMS/opennms/commit/c67d1cae2fa1fb806c9d422f6e6fbf4ebfde6b60
4
reference_url https://github.com/OpenNMS/opennms/pull/6365
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T21:49:38Z/
url https://github.com/OpenNMS/opennms/pull/6365
5
reference_url https://github.com/OpenNMS/opennms/pull/6366
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T21:49:38Z/
url https://github.com/OpenNMS/opennms/pull/6366
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-40311
reference_id CVE-2023-40311
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-40311
7
reference_url https://github.com/advisories/GHSA-qfw7-pfxx-h9q2
reference_id GHSA-qfw7-pfxx-h9q2
reference_type
scores
url https://github.com/advisories/GHSA-qfw7-pfxx-h9q2
fixed_packages
0
url pkg:maven/org.opennms/opennms-webapp@32.0.2
purl pkg:maven/org.opennms/opennms-webapp@32.0.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.opennms/opennms-webapp@32.0.2
aliases CVE-2023-40311, GHSA-qfw7-pfxx-h9q2
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hsec-2xnv-4qaa
1
url VCID-jv1e-p8ht-abfx
vulnerability_id VCID-jv1e-p8ht-abfx
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-40312
reference_id
reference_type
scores
0
value 0.00166
scoring_system epss
scoring_elements 0.37348
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-40312
1
reference_url https://docs.opennms.com/horizon/32/releasenotes/changelog.html
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T21:49:35Z/
url https://docs.opennms.com/horizon/32/releasenotes/changelog.html
2
reference_url https://github.com/OpenNMS/opennms
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/OpenNMS/opennms
3
reference_url https://github.com/OpenNMS/opennms/commit/1365ba9129f1762707fdbf1edd1f3e460bfb31e0
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/OpenNMS/opennms/commit/1365ba9129f1762707fdbf1edd1f3e460bfb31e0
4
reference_url https://github.com/OpenNMS/opennms/pull/6356
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T21:49:35Z/
url https://github.com/OpenNMS/opennms/pull/6356
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-40312
reference_id CVE-2023-40312
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-40312
6
reference_url https://github.com/advisories/GHSA-chgr-j2p9-jjh8
reference_id GHSA-chgr-j2p9-jjh8
reference_type
scores
url https://github.com/advisories/GHSA-chgr-j2p9-jjh8
fixed_packages
0
url pkg:maven/org.opennms/opennms-webapp@32.0.2
purl pkg:maven/org.opennms/opennms-webapp@32.0.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.opennms/opennms-webapp@32.0.2
aliases CVE-2023-40312, GHSA-chgr-j2p9-jjh8
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jv1e-p8ht-abfx
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.opennms/opennms-webapp@31.0.8