PT-2018-10478 · Opendaylight+1 · Opendaylight Sdninterfaceapp+1

Pedro Sampaio · Published 2018-06-20 · Updated 2019-10-09 · CVE-2018-1132

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opendaylight SDNInterfaceapp (SDNI) (affected versions not specified)

Description A flaw was found in Opendaylight's SDNInterfaceapp, allowing attackers to perform SQL injection on the component's database (SQLite) without authentication. The SDNInterface component has been deprecated since the final Carbon series release and is not included in newer OpenDayLight releases or packaged in the opendaylight package in RHEL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-1132

Affected Products

Opendaylight Sdninterfaceapp

Sqlite

References · 6

• 🔥 https://exploit-db.com/exploits/44747 · Exploit
• 🔥 https://jira.opendaylight.org/browse/SDNINTRFAC-14 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1132 · Security Note
• http://securityfocus.com/bid/104238 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132 · Note