CVE-2024-46943 OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability
A rogue controller can join an OpenDaylight cluster and impersonate an offline peer, bypassing authentication checks to gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46943?
CVE-2024-46943 is a critical authentication bypass vulnerability in n/a, published on 15 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.
Weakness: CWE-520
Which versions are affected by CVE-2024-46943?
2 open source packages ship an affected version, including org.opendaylight.aaa:aaa-artifacts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opendaylight.aaa:aaa-artifacts Maven | All versions to 0.19.3 | None |
org.opendaylight.aaa:aaa-artifacts Maven | All versions to 0.19.3 | None |
Products include Opendaylight Authentication\, Authorization and Accounting.
How do I fix CVE-2024-46943?
No fix has been published for CVE-2024-46943 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-46943 being exploited?
There is no known exploitation of CVE-2024-46943 in the wild and no public exploit code.
Sources
Also known as GHSA-46hr-3cq3-mcgp.