PT-2020-9282

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

CVE-2019-12114: Missing Authentication for Critical Function

An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12123: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12122: Cleartext Transmission of Sensitive Information

An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected...

CVE-2019-12116: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12121: Inadequate Encryption Strength

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

CVE-2019-12117: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

PT-2020-9283

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9277

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an authenticated user can execute an arbitrary command by executing sla/printAsGv with a crafted module parameter. All SDC setups that include admportal...

PT-2020-9288

Name of the Vulnerable Software and Affected Versions ONAP APPC versions prior to Dublin Description An issue was discovered in ONAP APPC, where an exposed unprotected Jolokia interface can be used by an unauthenticated attacker to read or overwrite an arbitrary file. All APPC setups are affected...

PT-2020-9286

Name of the Vulnerable Software and Affected Versions ONAP Portal through Dublin Description An issue was discovered in ONAP Portal, where an attacker who possesses a user's cookie may retrieve that user's password from the database by executing a call to "ONAPPORTAL/portalApi/loggedinUser". All...

PT-2020-9285

Name of the Vulnerable Software and Affected Versions ONAP Portal versions through Dublin Description An issue was detected in the ONAP Portal, where an attacker can execute a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field to decrypt arbitrary information encrypted wi...

PT-2020-9296

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an unauthenticated attacker can execute an arbitrary command by executing the "sla/dgUpload" endpoint with a crafted filename parameter. All SDC setups...

CVE-2019-12113: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12112: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected...

PT-2020-9279

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute arbitrary cod...

PT-2020-9284

Name of the Vulnerable Software and Affected Versions ONAP VNFSDK versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP VNFSDK, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9280

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...

PT-2020-9281

Name of the Vulnerable Software and Affected Versions ONAP SDC through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered that allows an unauthenticated attacker with access to pod-to-pod communication to execute arbitrary code inside the...

CVE-2019-12120: Missing Authentication for Critical Function

An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...