Erik Wynter

**Name of the Vulnerable Software and Affected Versions** OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 Meridian versions prior to 2023.1.5 **Description** The file editor in OpenMNS Horizon, accessible to users with `ROLE FILESYSTEM EDITOR` privileges, is vulnerable to XXE injection attacks. The software is intended for installation within an organization's private networks and should not be directly accessible from the Internet. **Recommendations** For OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2, upgrade to Horizon 32.0.2 or newer. For Meridian versions prior to 2023.1.5, upgrade to Meridian 2023.1.5 or newer.

**Name of the Vulnerable Software and Affected Versions** OpenMNS Horizon versions 31.0.8 through 32.0.2 Meridian versions prior to 2023.1.5 **Description** The issue allows any user with the `ROLE FILESYSTEM EDITOR` to easily escalate their privileges to `ROLE ADMIN` or any other role. The affected software is intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue. **Recommendations** To resolve the issue, upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. As a temporary workaround, consider restricting the use of the `ROLE FILESYSTEM EDITOR` role until a patch is available. Restrict access to the affected software to minimize the risk of exploitation, following the installation instructions that state the software should not be directly accessible from the Internet.

**Name of the Vulnerable Software and Affected Versions** OpenMNS Horizon versions 31.0.8 through 32.0.2 Meridian (affected versions not specified) **Description** The Horizon REST API includes a "users" endpoint that is vulnerable to elevation of privilege. The solution is to upgrade to a newer version. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue. **Recommendations** For OpenMNS Horizon versions 31.0.8 through 32.0.2, upgrade to Horizon 32.0.2 or newer. For Meridian, upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, or 2020.1.38. As a temporary workaround, consider restricting access to the "users" endpoint in the Horizon REST API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenNMS Horizon versions 31.0.8 through 32.0.2 **Description** The issue is related to an XML external entity (XXE) injection vulnerability in the `/rtc/post/` endpoint, which can be used to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to a newer version. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. **Recommendations** To resolve the issue, upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. As a temporary workaround, consider restricting access to the `/rtc/post/` endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FlexDotnetCMS versions prior to 1.5.11 **Description** The issue allows an authenticated remote attacker to bypass access controls and read and write to existing files outside the web root via directory traversal by entering a .. (dot dot) path in the input field of the "FileEditor" at the "/Admin/Views/FileEditor/" endpoint. In versions prior to 1.5.8, it is also possible to access files by specifying the full path. **Recommendations** For versions prior to 1.5.11, update to version 1.5.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileEditor feature until a patch is available. Avoid using the FileEditor to access files outside the web root until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FlexDotnetCMS versions prior to 1.5.9 **Description** The issue allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code in the form of a safe file type and then renaming the file to an executable extension using the FileEditor or the FileManager's rename function. The attacker can then execute the file via an HTTP GET request to the file's path. **Recommendations** For versions prior to 1.5.9, update to version 1.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileManager and FileEditor to minimize the risk of exploitation. Avoid using the rename function in the FileManager to prevent malicious file uploads.