CVE-2024-37018

EUVD-2024-37029
The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Common Weakness Enumeration
References
https://dl.acm.org/doi/10.1145/3658644.3690345
https://github.com/mzc796/marionette_odl
https://github.com/mzc796/marionette_onos
https://jira.opendaylight.org/browse/DISCOVERY-2
https://mvnrepository.com/artifact/org.opendaylight.controller
https://jira.opendaylight.org/browse/DISCOVERY-2
https://mvnrepository.com/artifact/org.opendaylight.controller