PT-2024-32292 · Opendaylight · Opendaylight Authentication

Name of the Vulnerable Software and Affected Versions: OpenDaylight Authentication, Authorization and Accounting AAA versions through 0.19.3 Description: An issue was discovered in OpenDaylight Authentication, Authorization and Accounting AAA. A rogue controller can join a cluster to impersonate ...

CVE-2024-46942

In OpenDaylight Model-Driven Service Abstraction Layer MD-SAL through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment...

CVE-2024-46942

In OpenDaylight Model-Driven Service Abstraction Layer MD-SAL through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment...

CVE-2024-46943

OpenDaylight Authentication, Authorization and Accounting (AAA) versions through 0.19.3 are vulnerable to an improper authorization issue. The root cause is inadequate validation of cluster membership , which allows a rogue controller to join a cluster and impersonate an offline peer , even witho...

CVE-2024-46943: .NET Misconfiguration: Use of Impersonation

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting AAA through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information...

CVE-2024-46943

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting AAA through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information...

CVE-2024-46942

The OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) , specifically the mdsal-artifacts component in versions through 13.0.1 , is vulnerable to Improper Authorization (CWE-285). The root cause is improper role enforcement, which allows a controller with a follower role to unauthorized...

RHEL 7 : opendaylight (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - plexus-utils: Mishandled strings in Commandline class allow for command injection CVE-2017-1000487 Note that Nessus...

RHEL 8 : opendaylight (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Serialization gadgets in classes of the ehcache package CVE-2019-17267 - A flaw was...

CVE-2024-37018

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets...

CVE-2024-37018

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets...

CVE-2024-37018

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets...

CVE-2024-37018

The OpenDaylight controller, specifically version 0.15.3 , is vulnerable to topology poisoning via API requests. The root cause is that an application can manipulate the path taken by discovery packets, a flaw categorized under CWE-648 (Incorrect Use of Privileged APIs). This vulnerability allows...

PT-2024-27246 · Unknown · Opendaylight

Name of the Vulnerable Software and Affected Versions: OpenDaylight version 0.15.3 Description: The issue allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets. Recommendations: For OpenDaylight version 0.15.3, consider...

OpenDaylight Security Vulnerabilities

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight version 0.15.3 that stems from allowing topology poisoning via API requests...

CVE-2024-37018: Incorrect Use of Privileged APIs

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets...

RHEL 7 : opendaylight (RHSA-2018:2598)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2598 advisory. OpenDaylight ODL is a modular open platform for customizing and automating networks of any size and scale. The OpenDaylight Project arose out of the...

CVE-2022-45931

A SQL injection issue was discovered in the AAA package of OpenDaylight. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used. This may allow a malicious user to execute arbitrary sql...

CVE-2022-45932

A SQL injection issue was discovered in the AAA package of OpenDaylight. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used. This may allow a malicious user to execute arbitrary sql...

CVE-2022-45930

A SQL injection issue was discovered in the AAA package of OpenDaylight. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is affected for the /auth/v1/domains/ API interface. This may allow a malicious user to execute arbitrary sql...