CVE-2018-1132CWE-89

A flaw was found in Opendaylight's SDNInterfaceapp (SDNI)

High · published June 20, 2018

CVSS v3.0
7.5
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02816 · 86.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2018-06-20T13:00Z
EPSS history
Timeline
  • 20 JUN 13:00Z
    A flaw was found in Opendaylight's SDNInterfaceapp (SDNI)
    cvelistv5