PT-2017-6516
CVE-2015-1778
·
Published
2017-06-27
·
Updated
2022-05-17
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Opendaylight versions prior to Helium SR3
Description
The issue concerns the custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight. This realm will authenticate any username and password combination, indicating a significant security flaw.
Recommendations
For versions prior to Helium SR3, update to Helium SR3 or later to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾