Vulnerability Details : CVE-2018-1132
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2018-1132
Probability of exploitation activity in the next 30 days: 0.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 70 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2018-1132
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
Red Hat, Inc. |
CWE ids for CVE-2018-1132
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2018-1132
-
http://www.securityfocus.com/bid/104238
OpenDaylight Controller 'SdniDataBase.java' SQL Injection VulnerabilityThird Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1132
1576947 – (CVE-2018-1132) CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL InjectionIssue Tracking;Third Party Advisory
-
https://www.exploit-db.com/exploits/44747/
404 Page Not Found | Exploit DatabaseExploit;Third Party Advisory;VDB Entry
-
https://jira.opendaylight.org/browse/SDNINTRFAC-14
[SDNINTRFAC-14] SQL injection in the component database(SQLite) without authenticating to the controller or SDNInterfaceapp. - OpenDaylight JIRAExploit;Third Party Advisory
Products affected by CVE-2018-1132
- cpe:2.3:a:opendaylight:sdninterfaceapp:*:*:*:*:*:*:*:*