CyberSec.Space Logo
返回 CVE 浏览器

CVE-2018-1000616

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0120%
EPSS Percentile27.57th
Published2018年7月9日
Last Modified2024年11月21日

Vulnerability Description

ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity.

Affected Platforms (CPE)

📦
Onosproject

Onos

<= 1.13.1

References & Advisories

🔗 http://gms.cl0udz.com/Openconfig_xxe.pdf
🔗 https://gerrit.onosproject.org/#/c/18894/
🔗 http://gms.cl0udz.com/Openconfig_xxe.pdf
🔗 https://gerrit.onosproject.org/#/c/18894/

相关漏洞威胁

CVE-2019-136249.8

In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within s...

CVE-2019-10102459.8

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A rem...

CVE-2018-10006149.8

ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/...

CVE-2019-10102349.8

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely ex...