CVE-2018-12691

medium

Description

Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection.

References

Advisories

https://wiki.onosproject.org/display/ONOS/Security+advisories

https://gerrit.onosproject.org/#/c/18867/

Details

Source: Mitre, NVD

Published: 2018-07-05

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N