PT-2020-9295

Name of the Vulnerable Software and Affected Versions ONAP APPC versions through Dublin ONAP SDC versions through Dublin Description An issue allows an attacker to impersonate an arbitrary existing user without authentication by setting the USER ID parameter in an HTTP header. All APPC and SDC...

PT-2020-9278

Name of the Vulnerable Software and Affected Versions ONAP HOLMES versions prior to Dublin ONAP Operations Manager OOM affected versions not specified Description An issue was discovered in ONAP HOLMES. By accessing port 9202 of the dep-holmes-engine-mgmt pod, an unauthenticated attacker who...

PT-2020-9276

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an unauthenticated attacker can execute an arbitrary command by executing sla/upload with a crafted filename parameter. All SDC setups that include...

CVE-2019-12132: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected...

CVE-2019-12118: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

PT-2020-9287

Name of the Vulnerable Software and Affected Versions ONAP SDNC versions prior to Dublin Description An issue was discovered in ONAP SDNC where an authenticated user can execute an arbitrary command by executing sla/printAsXml with a crafted module parameter. All SDC setups that include admportal...

CVE-2019-12115: Missing Authentication for Critical Function

An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker who already has access to pod-to-pod communication may execute arbitrary code inside that pod. All ONAP Operations Manager OOM setups are affected...

PT-2020-9283

Name of the Vulnerable Software and Affected Versions ONAP SDC versions through Dublin ONAP Operations Manager OOM setups affected versions not specified Description An issue was discovered in ONAP SDC, allowing an unauthenticated attacker with access to pod-to-pod communication to execute...