PT-2020-9288 · Onap · Onap Appc

Published 2020-03-18 · Updated 2020-08-24 · CVE-2019-12124

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ONAP APPC versions prior to Dublin

Description An issue was discovered in ONAP APPC, where an exposed unprotected Jolokia interface can be used by an unauthenticated attacker to read or overwrite an arbitrary file. All APPC setups are affected.

Recommendations For versions prior to Dublin, consider disabling the exposed Jolokia interface as a temporary workaround until a patch is available. Restrict access to the Jolokia interface to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-12124

Affected Products

Onap Appc

References · 5

• 🔥 https://jira.onap.org/browse/OJSI-63 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12124 · Security Note
• https://t.me/cvenotify/1875 · Telegram Post
• https://t.me/cibsecurity/10588 · Telegram Post