CVE-2014-5035 The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, rela...
MediumCVSS 6.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opendaylight | = 1.0 | No fix listed |
References
- packetstormsecurity.com
- 20140812 CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service mailing-list
- 20140812 CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service mailing-list
- opendaylight-cve20145035-file-include(95254) vdb-entry