Description (CNA)
The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://seclists.org/fulldisclosure/2014/Aug/34
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95254
- http://www.securityfocus.com/archive/1/533114/100/0/threaded
- http://packetstormsecurity.com/files/127843/Opendaylight-1.0-Local-File-Inclusion-Remote-File-Inclusion.html
ADP enrichment
No English description supplied.