{"api_version":"1","generated_at":"2026-04-21T10:21:19+00:00","cve":"CVE-2018-1132","urls":{"html":"https://cve.report/CVE-2018-1132","api":"https://cve.report/api/cve/CVE-2018-1132.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1132","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1132"},"summary":{"title":"CVE-2018-1132","description":"A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2018-06-20 13:29:00","updated_at":"2019-10-09 23:38:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"https://www.exploit-db.com/exploits/44747/","name":"44747","refsource":"EXPLOIT-DB","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"404 Page Not Found | Exploit Database","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://jira.opendaylight.org/browse/SDNINTRFAC-14","name":"https://jira.opendaylight.org/browse/SDNINTRFAC-14","refsource":"CONFIRM","tags":["Exploit","Third Party Advisory"],"title":"[SDNINTRFAC-14] SQL injection in the component database(SQLite) without authenticating to the controller or SDNInterfaceapp. - OpenDaylight JIRA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/104238","name":"104238","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"OpenDaylight Controller 'SdniDataBase.java' SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"1576947 – (CVE-2018-1132) CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1132","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1132","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1132","vulnerable":"1","versionEndIncluding":"carbon-sr4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"opendaylight","cpe5":"sdninterfaceapp","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2018-1132","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89","cweId":"CWE-89"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"[UNKNOWN]","product":{"product_data":[{"product_name":"opendaylight","version":{"version_data":[{"version_affected":"=","version_value":"n/a"}]}}]}}]}},"references":{"reference_data":[{"url":"http://www.securityfocus.com/bid/104238","refsource":"MISC","name":"http://www.securityfocus.com/bid/104238"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132","refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132"},{"url":"https://jira.opendaylight.org/browse/SDNINTRFAC-14","refsource":"MISC","name":"https://jira.opendaylight.org/browse/SDNINTRFAC-14"},{"url":"https://www.exploit-db.com/exploits/44747/","refsource":"MISC","name":"https://www.exploit-db.com/exploits/44747/"}]},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.0"}]}},"nvd":{"publishedDate":"2018-06-20 13:29:00","lastModifiedDate":"2019-10-09 23:38:00","problem_types":["CWE-89"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:opendaylight:sdninterfaceapp:*:*:*:*:*:*:*:*","versionEndIncluding":"carbon-sr4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1132","Ordinal":"116363","Title":"CVE-2018-1132","CVE":"CVE-2018-1132","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1132","Ordinal":"1","NoteData":"A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1132","Ordinal":"2","NoteData":"2018-06-20","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1132","Ordinal":"3","NoteData":"2018-06-21","Type":"Other","Title":"Modified"}]}}}