CyberSec.Space Logo
Back to CVE Browser

CVE-2018-1000616

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0120%
EPSS Percentile27.57th
PublishedJul 9, 2018
Last ModifiedNov 21, 2024

Vulnerability Description

ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity.

Affected Platforms (CPE)

📦
Onosproject

Onos

<= 1.13.1

References & Advisories

🔗 http://gms.cl0udz.com/Openconfig_xxe.pdf
🔗 https://gerrit.onosproject.org/#/c/18894/
🔗 http://gms.cl0udz.com/Openconfig_xxe.pdf
🔗 https://gerrit.onosproject.org/#/c/18894/

Related Vulnerabilities

CVE-2019-136249.8

In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within s...

CVE-2019-10102459.8

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A rem...

CVE-2018-10006149.8

ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/...

CVE-2019-10102349.8

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely ex...