PT-2020-9290 · Linux Foundation · Onap Dcae+1

Published 2020-03-19 · Updated 2020-03-20 · CVE-2019-12126

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONAP DCAE versions through Dublin ONAP Operations Manager (OOM) setups (affected versions not specified)

Description The issue allows an attacker to gain full access to ONAP services without authentication by accessing specific ports. The affected ports include 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and 30271.

Recommendations For ONAP DCAE versions through Dublin, restrict access to the specified ports (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and 30271) to prevent unauthorized access. For all ONAP Operations Manager (OOM) setups, consider implementing authentication mechanisms for ONAP services to mitigate the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-12126

Affected Products

Onap Dcae

Onap Operations Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-12126 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12126 · Vendor Advisory
• https://jira.onap.org/browse/OJSI-27 · Note