PT-2018-10478 · Opendaylight+1 · Opendaylight Sdninterfaceapp+1

Pedro Sampaio · Publicado 2018-06-20 · Atualizado 2019-10-09 · CVE-2018-1132

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opendaylight SDNInterfaceapp (SDNI) (affected versions not specified)

Description A flaw was found in Opendaylight's SDNInterfaceapp, allowing attackers to perform SQL injection on the component's database (SQLite) without authentication. The SDNInterface component has been deprecated since the final Carbon series release and is not included in newer OpenDayLight releases or packaged in the opendaylight package in RHEL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-1132

Produtos afetados

Opendaylight Sdninterfaceapp

Sqlite

Referências · 6

• 🔥 https://exploit-db.com/exploits/44747 · Exploit
• 🔥 https://jira.opendaylight.org/browse/SDNINTRFAC-14 · Exploit
• http://securityfocus.com/bid/104238 · Nota
• https://osv.dev/vulnerability/CVE-2018-1132 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1132 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132 · Nota