CVE-2018-1132

NONE EPSS 85.0%
Published Jun 20, 20188y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jun 20, 2018 8y ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.

Threat Intelligence

EPSS Exploit Probability
85.0% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
opendaylightsdninterfaceapp* ≤carbon-sr4

References 4

  • securityfocus.com http://www.securityfocus.com/bid/104238
    Third Party AdvisoryVDB Entry
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132
    Issue TrackingThird Party Advisory
  • jira.opendaylight.org https://jira.opendaylight.org/browse/SDNINTRFAC-14
    ExploitThird Party Advisory
  • exploit-db.com https://www.exploit-db.com/exploits/44747/
    ExploitThird Party AdvisoryVDB Entry

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.