PT-2014-6260 · Linux Foundation · Opendaylight

Publicado 2014-08-26 · Atualizado 2018-10-09 · CVE-2014-5035

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenDaylight version 1.0

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.

Recommendations For OpenDaylight version 1.0, consider disabling the Netconf (TCP) service until a patch is available to prevent exploitation of the XXE issue.

Correção

Identificadores relacionados

CVE-2014-5035

Produtos afetados

Opendaylight

Referências · 5

• http://seclists.org/fulldisclosure/2014/Aug/34 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95254 · Nota
• http://securityfocus.com/archive/1/533114/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5035 · Nota de Segurança
• http://packetstormsecurity.com/files/127843/Opendaylight-1.0-Local-File-Inclusion-Remote-File-Inclusion.html · Nota