PT-2020-9295
CVE-2019-12131
·
تاريخ النشر
2020-03-18
·
تاريخ التحديث
2020-03-20
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
ONAP APPC versions through Dublin
ONAP SDC versions through Dublin
Description
An issue allows an attacker to impersonate an arbitrary existing user without authentication by setting the
USER ID parameter in an HTTP header. All APPC and SDC setups are affected.Recommendations
For ONAP APPC versions through Dublin, consider restricting access to the
USER ID parameter in HTTP headers until a fix is available.
For ONAP SDC versions through Dublin, avoid using the USER ID parameter in HTTP headers until the issue is resolved.
As a temporary workaround, consider disabling the ability to set the USER ID parameter in HTTP headers for all APPC and SDC setups until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾