Lucene search

MitreCVE-2024-46943

HistorySep 15, 2024 - 11:15 p.m.

CVE-2024-46943

2024-09-1523:15:11

CWE-520

mitre

web.nvd.nist.gov

opendaylight

authentication

authorization

accounting

aaa

vulnerability

controller impersonation

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

16.3%

JSON

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

References

docs.opendaylight.org/en/latest/release-notes/projects/aaa.html

doi.org/10.48550/arXiv.2408.16940

lf-opendaylight.atlassian.net/browse/AAA-285

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

16.3%

JSON

Related for CVE-2024-46943