PT-2020-9285 · Unknown · Onap Portal

Published 2020-03-18 · Updated 2021-07-21 · CVE-2019-12121

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ONAP Portal versions through Dublin

Description An issue was detected in the ONAP Portal, where an attacker can execute a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected.

Recommendations For ONAP Portal versions through Dublin, consider disabling the ONAPPORTAL/processSingleSignOn endpoint or restricting access to the UserId field until a patch is available. As a temporary workaround, restrict the use of the symmetric key used for UserId encryption to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2019-12121

Affected Products

Onap Portal

References · 5

• 🔥 https://jira.onap.org/browse/OJSI-92 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12121 · Security Note
• https://t.me/cibsecurity/10591 · Telegram Post
• https://t.me/cvenotify/1872 · Telegram Post