PT-2018-9471 · Atlassian · Floodlight Controller

Published 2018-07-09 · Updated 2018-09-08 · CVE-2018-1000617

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Floodlight Controller versions 1.2 and earlier

Description The issue is related to a Denial of Service vulnerability in the Forwarding module, which can result in an improper type cast. This allows remote attackers to cause a Denial of Service, resulting in a thread crash. The attack is exploitable via network connectivity, indicating it can be launched remotely.

Recommendations For Atlassian Floodlight Controller versions 1.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1000617

Affected Products

Floodlight Controller

References · 4

• 🔥 http://gms.cl0udz.com/Floodlight_DoS.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000617 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000617 · Vendor Advisory
• http://securityfocus.com/bid/104711 · Note