CVE-2019-12131

Name of the Vulnerable Software and Affected Versions ONAP APPC versions through Dublin ONAP SDC versions through Dublin

Description An issue allows an attacker to impersonate an arbitrary existing user without authentication by setting the USER ID parameter in an HTTP header. All APPC and SDC setups are affected.

Recommendations For ONAP APPC versions through Dublin, consider restricting access to the USER ID parameter in HTTP headers until a fix is available. For ONAP SDC versions through Dublin, avoid using the USER ID parameter in HTTP headers until the issue is resolved. As a temporary workaround, consider disabling the ability to set the USER ID parameter in HTTP headers for all APPC and SDC setups until a patch is available.