CRSA-2015-0004.yaml

title: 'OpenDaylight information disclosure'

description: 'It was found that the OpenDaylight MD-SAL API docs did not require authentication. The API docs contain potentially sensitive information, such as which devices are mounted on the server. A remote, unauthenticated attacker could use this flaw to gain information about the OpenDaylight server that could assist in the exploitation of another vulnerability.'

references: 
  - https://wiki.opendaylight.org/view/Security_Advisories#.5BLow.5D_CVE-2015-1857_MD-SAL:_information_disclosure

affected-products:

  - product: CloudRouter
    version:
      - id: 1.0-beta
        component: opendaylight-helium
        issues:
          - 59
        patches:
          - https://git.opendaylight.org/gerrit/#/c/17709/

vulnerabilities:

  - cve-id: CVE-2015-1857
    cloudrouter-security-issue: 4
    impact-assessment:
      source: 'IIX Product Security'
      rating: low
      assessment:
        type: CVSS2
        score: 5
        detail: AV:N/AC:L/Au:N/C:P/I:N/A:N
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO

reporters:

  - name: 'Ryan Goulding'
    reported:
      - CVE-2015-1857