Vulnerability Details : CVE-2018-1132
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.
Vulnerability category: Sql Injection
Products affected by CVE-2018-1132
- cpe:2.3:a:opendaylight:sdninterfaceapp:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1132
0.32%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1132
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
Red Hat, Inc. |
CWE ids for CVE-2018-1132
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2018-1132
-
http://www.securityfocus.com/bid/104238
OpenDaylight Controller 'SdniDataBase.java' SQL Injection VulnerabilityThird Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132
1576947 – (CVE-2018-1132) CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL InjectionIssue Tracking;Third Party Advisory
-
https://www.exploit-db.com/exploits/44747/
404 Page Not Found | Exploit DatabaseExploit;Third Party Advisory;VDB Entry
-
https://jira.opendaylight.org/browse/SDNINTRFAC-14
[SDNINTRFAC-14] SQL injection in the component database(SQLite) without authenticating to the controller or SDNInterfaceapp. - OpenDaylight JIRAExploit;Third Party Advisory
Jump to