PT-2014-6260 · Linux Foundation · Opendaylight

Published 2014-08-26 · Updated 2018-10-09 · CVE-2014-5035

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenDaylight version 1.0

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.

Recommendations For OpenDaylight version 1.0, consider disabling the Netconf (TCP) service until a patch is available to prevent exploitation of the XXE issue.

Fix

Related Identifiers

CVE-2014-5035

Affected Products

Opendaylight

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-5035 · Security Note
• http://seclists.org/fulldisclosure/2014/Aug/34 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95254 · Note
• http://securityfocus.com/archive/1/533114/100/0/threaded · Note
• http://packetstormsecurity.com/files/127843/Opendaylight-1.0-Local-File-Inclusion-Remote-File-Inclusion.html · Note