CVE-2018-1132 SQL injection in opendaylight
Unauthenticated attackers can perform SQL injection on the SDNInterfaceapp database, allowing data access or modification in the deprecated OpenDaylight component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1132?
CVE-2018-1132 is a high-severity SQL injection vulnerability in [UNKNOWN] opendaylight, published on 20 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.
Weakness: CWE-89
Which versions are affected by CVE-2018-1132?
It affects 1 product.
Products include Opendaylight Sdninterfaceapp.
How do I fix CVE-2018-1132?
No fix has been published for CVE-2018-1132 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-1132 being exploited?
There is no known exploitation of CVE-2018-1132 in the wild and no public exploit code.
Sources
Also known as GHSA-x783-p293-jq6f.