CVE-2024-46943

Sept. 20, 2024, 4:56 p.m.

7.5
High

Description

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

Product(s) Impacted

Vendor Product Versions
Opendaylight
  • Authentication\, Authorization And Accounting
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-520
.NET Misconfiguration: Use of Impersonation
Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a opendaylight authentication\,_authorization_and_accounting / / / / / / / /

References

https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html
https://doi.org/10.48550/arXiv.2408.16940
https://lf-opendaylight.atlassian.net/browse/AAA-285

Tags

cve@mitre.org
NVD-CWE-noinfo
2024-09-15
CVE-2024-46943
CWE-520

CVSS Score

7.5 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Date

  • Published: Sept. 15, 2024, 11:15 p.m.
  • Last Modified: Sept. 20, 2024, 4:56 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.