PT-2020-9277

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an authenticated user can execute an arbitrary command by executing sla/printAsGv with a crafted module parameter. All SDC setups that include admportal...

PT-2020-9284

Name of the Vulnerable Software and Affected Versions ONAP VNFSDK versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP VNFSDK, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9288

Name of the Vulnerable Software and Affected Versions ONAP APPC versions prior to Dublin Description An issue was discovered in ONAP APPC, where an exposed unprotected Jolokia interface can be used by an unauthenticated attacker to read or overwrite an arbitrary file. All APPC setups are affected...

PT-2020-9286

Name of the Vulnerable Software and Affected Versions ONAP Portal through Dublin Description An issue was discovered in ONAP Portal, where an attacker who possesses a user's cookie may retrieve that user's password from the database by executing a call to "ONAPPORTAL/portalApi/loggedinUser". All...

PT-2020-9285

Name of the Vulnerable Software and Affected Versions ONAP Portal versions through Dublin Description An issue was detected in the ONAP Portal, where an attacker can execute a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field to decrypt arbitrary information encrypted wi...

PT-2020-9280

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9282

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9281

Name of the Vulnerable Software and Affected Versions ONAP SDC through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered that allows an unauthenticated attacker with access to pod-to-pod communication to execute arbitrary code inside the...

PT-2020-9279

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute arbitrary cod...

PT-2020-9276

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an unauthenticated attacker can execute an arbitrary command by executing sla/upload with a crafted filename parameter. All SDC setups that include...

PT-2020-9295

Name of the Vulnerable Software and Affected Versions ONAP APPC versions through Dublin ONAP SDC versions through Dublin Description An issue allows an attacker to impersonate an arbitrary existing user without authentication by setting the USER ID parameter in an HTTP header. All APPC and SDC...

CVE-2019-12131: Authentication Bypass by Spoofing

An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USERID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected...

CVE-2019-12132: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12124: Undefined Security Weakness

An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected...

CVE-2019-12123: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12122: Cleartext Transmission of Sensitive Information

An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected...

CVE-2019-12121: Inadequate Encryption Strength

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

CVE-2019-12119: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12118: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12117: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...