Atlassian Floodlight vulnerabilities

4 CVEs affecting Atlassian Floodlight, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-18685, published 2021-09-30.

More from Atlassian.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-6569, published 2018-02-21. Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days. Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and thread crash) via a…
• CVE-2020-18685, published 2021-09-30. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs.
• CVE-2020-18684, published 2021-09-30. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number.
• CVE-2020-18683, published 2021-09-30. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling.