Linuxfoundation Opendaylight vulnerabilities

5 CVEs affecting Linuxfoundation Opendaylight, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-37018, published 2024-05-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1857, published 2018-04-27. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
CVE-2022-45930, published 2022-11-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is…
CVE-2022-45932, published 2022-11-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected…
CVE-2022-45931, published 2022-11-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected…
CVE-2024-37018, published 2024-05-31. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.