9.1
CVE-2019-12131
- EPSS 0.3%
- Veröffentlicht 18.03.2020 19:15:14
- Zuletzt bearbeitet 21.11.2024 04:22:16
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginAn issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Onap ≫ Open Network Automation Platform Version >= 3.0.0 < 4.0.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.526 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
CWE-290 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.