CRITICAL🇵🇱 Wersja polska

CVE-2018-1000614

CVSS 9.8v3.0pub. 2018-07-09upd. 2024-11-21

ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Onosproject Onos

    APP
    Onosproject
    ≤ 1.13.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XXE
CWE
References

Related vulnerabilities

CVE-2019-13624CRITICAL9.8PL ✓same product

Command injection w ONOS 1.15.0 poprzez znaki backquote w YangWebResource

CVE-2018-1000616CRITICAL9.8PL ✓same product

XXE w kontrolerze ONOS — zdalne odczytanie plików i wykonanie żądań SSRF

CVE-2017-1000081CRITICAL9.8PL ✓same product

RCE poprzez nieuwierzytelniony upload aplikacji w ONOS 1.9.0

CVE-2018-1000615HIGH7.5same product

ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in ...

CVE-2017-13763HIGH7.5same product

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size ...