CVE-2014-5035

Description

The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/95254

http://www.securityfocus.com/archive/1/533114/100/0/threaded

http://seclists.org/fulldisclosure/2014/Aug/34

http://packetstormsecurity.com/files/127843/Opendaylight-1.0-Local-File-Inclusion-Remote-File-Inclusion.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS