PT-2020-9292 · Linux Foundation · Onap Operations Manager+1

Published 2020-03-19 · Updated 2020-08-24 · CVE-2019-12128

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ONAP SO through Dublin ONAP Operations Manager (OOM) setups (affected versions not specified)

Description The issue allows an attacker to gain full access to ONAP services without authentication by accessing specific ports, including 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271. All ONAP Operations Manager setups are affected.

Recommendations For ONAP SO through Dublin, restrict access to the specified ports (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271) to prevent unauthorized access. For ONAP Operations Manager (OOM) setups, consider implementing additional authentication mechanisms to prevent full access to services without proper credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-12128

Affected Products

Onap Operations Manager

Onap So

References · 4

• https://jira.onap.org/browse/OJSI-27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12128 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12128 · Vendor Advisory
• https://t.me/cibsecurity/10627 · Telegram Post