CVE-2023-0815 MEDIUM

CVE-2023-0815: Plaintext Password Present in the Web logs

Vendor The Opennms Group
Product Meridian
Weakness CWE-532 · Sensitive info in logs
Published February 23, 2023
Last update March 11, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Key dates

02Disclosure timeline

February 23, 2023 CVE published
March 11, 2025 Record updated