CVE-2019-12121: Onap Open Network Automation Platform

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected.

Affected products

• Onap Open Network Automation Platform: from 3.0.0, before 4.0.0 (fixed in 4.0.0)

Published 2020-03-18. Last modified 2026-06-17.