CVE-2018-1132
Summary
| CVE | CVE-2018-1132 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-06-20 13:29:00 UTC |
| Updated | 2019-10-09 23:38:00 UTC |
| Description | A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL. |
Risk And Classification
Problem Types: CWE-89
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Opendaylight | Sdninterfaceapp | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 404 Page Not Found | Exploit Database | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| [SDNINTRFAC-14] SQL injection in the component database(SQLite) without authenticating to the controller or SDNInterfaceapp. - OpenDaylight JIRA | CONFIRM | jira.opendaylight.org | Exploit, Third Party Advisory |
| OpenDaylight Controller 'SdniDataBase.java' SQL Injection Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| 1576947 – (CVE-2018-1132) CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL Injection | CONFIRM | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.