Bug 2149431 (CVE-2022-45931) - CVE-2022-45931 opendaylight: sql injection
Summary: CVE-2022-45931 opendaylight: sql injection
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2022-45931
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2148829
TreeView+ depends on / blocked
 
Reported: 2022-11-29 21:29 UTC by Anten Skrabec
Modified: 2022-11-30 18:22 UTC (History)
9 users (show)

Fixed In Version: opendaylight 0.17.0, opendaylight 0.15.7, opendaylight 0.16.5
Doc Type: ---
Doc Text:
A SQL injection issue was discovered in the AAA package of OpenDaylight. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used. This may allow a malicious user to execute arbitrary sql statements against the database.
Clone Of:
Environment:
Last Closed: 2022-11-29 21:34:29 UTC
Embargoed:

Attachments (Terms of Use)

Description Anten Skrabec 2022-11-29 21:29:45 UTC 
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used.
Note You need to log in before you can comment on or make changes to this bug.