PT-2020-9284 · Onap · Onap Operations Manager+1

Published 2020-03-18 · Updated 2021-07-21 · CVE-2019-12120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONAP VNFSDK versions through Dublin ONAP Operations Manager (OOM) setups (affected versions not specified)

Description An issue was discovered in ONAP VNFSDK, allowing an unauthenticated attacker with access to pod-to-pod communication to execute arbitrary code inside a pod by accessing port 8000 of demo-vnfsdk-vnfsdk. All ONAP Operations Manager (OOM) setups are affected.

Recommendations For ONAP VNFSDK versions through Dublin, consider restricting access to port 8000 of demo-vnfsdk-vnfsdk to prevent arbitrary code execution. For ONAP Operations Manager (OOM) setups, restrict pod-to-pod communication to minimize the risk of exploitation. As a temporary workaround, consider disabling access to demo-vnfsdk-vnfsdk until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-12120

Affected Products

Onap Operations Manager

Onap Vnfsdk

References · 5

• 🔥 https://jira.onap.org/browse/OJSI-10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12120 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12120 · Vendor Advisory
• https://t.me/cibsecurity/10592 · Telegram Post
• https://t.me/cvenotify/1871 · Telegram Post