CVE-2019-12116: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12115: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12114: Missing Authentication for Critical Function

An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12113: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12112: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected...

PT-2020-9296

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an unauthenticated attacker can execute an arbitrary command by executing the "sla/dgUpload" endpoint with a crafted filename parameter. All SDC setups...

CVE-2019-12120: Missing Authentication for Critical Function

An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

PT-2020-9278

Name of the Vulnerable Software and Affected Versions ONAP HOLMES versions prior to Dublin ONAP Operations Manager OOM affected versions not specified Description An issue was discovered in ONAP HOLMES. By accessing port 9202 of the dep-holmes-engine-mgmt pod, an unauthenticated attacker who...