GitHub Advisoryadvisory · Maven

GHSA-46hr-3cq3-mcgp OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability

MEDIUM Published 2024-09-16 Modified 2024-09-16 Official page ↗
Aliases
CVE-2024-46943
Ecosystem
Maven
Packages
org.opendaylight.aaa:aaa-artifacts
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-285, CWE-287, CWE-520
Reviewed
2024-09-16

Affected packages

• Maven org.opendaylight.aaa:aaa-artifacts: <= 0.19.3 (no fix yet)

Description

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

Related

Alias · CVE (1)

  • CVE-2024-46943 An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. vulnerability

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness
  • CWE-520 .NET Misconfiguration: Use of Impersonation weakness

References