CVE-2024-46942 OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries
A follower-role controller in OpenDaylight clustering can improperly configure flow entries due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46942?
CVE-2024-46942 is a critical missing authorization vulnerability in n/a, published on 15 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.
Weakness: CWE-285
Which versions are affected by CVE-2024-46942?
2 open source packages ship an affected version, including org.opendaylight.mdsal:mdsal-artifacts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opendaylight.mdsal:mdsal-artifacts Maven | All versions to 13.0.1 | None |
org.opendaylight.mdsal:mdsal-artifacts Maven | All versions to 13.0.1 | None |
Products include Opendaylight Model-Driven Service Abstraction Layer.
How do I fix CVE-2024-46942?
No fix has been published for CVE-2024-46942 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-46942 being exploited?
There is no known exploitation of CVE-2024-46942 in the wild and no public exploit code.
Sources
Also known as GHSA-hv38-h5pj-c96j.