cloudrouter-security/CRSA-2015-0004.yaml at master · cloudrouter/cloudrouter-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
title: 'OpenDaylight information disclosure'

description: 'It was found that the OpenDaylight MD-SAL API docs did not require authentication. The API docs contain potentially sensitive information, such as which devices are mounted on the server. A remote, unauthenticated attacker could use this flaw to gain information about the OpenDaylight server that could assist in the exploitation of another vulnerability.'

references:
  - https://wiki.opendaylight.org/view/Security_Advisories#.5BLow.5D_CVE-2015-1857_MD-SAL:_information_disclosure

affected-products:

  - product: CloudRouter
    version:
      - id: 1.0-beta
        component: opendaylight-helium
        issues:
          - 59
        patches:
          - https://git.opendaylight.org/gerrit/#/c/17709/

vulnerabilities:

  - cve-id: CVE-2015-1857
    cloudrouter-security-issue: 4
    impact-assessment:
      source: 'IIX Product Security'
      rating: low
      assessment:
        type: CVSS2
        score: 5
        detail: AV:N/AC:L/Au:N/C:P/I:N/A:N
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO

reporters:

  - name: 'Ryan Goulding'
    reported:
      - CVE-2015-1857