CVE-2019-12113 : Security Advisory and Response

A vulnerability has been found in ONAP SDNC prior to the Dublin release that allows an authenticated user to execute arbitrary commands.

Understanding CVE-2019-12113

This CVE identifies a security issue in ONAP SDNC that can be exploited by manipulating a specific command.

What is CVE-2019-12113?

This vulnerability in ONAP SDNC before the Dublin release enables a user authenticated within the system to execute arbitrary commands by utilizing a specific command and manipulating a parameter.

The Impact of CVE-2019-12113

The vulnerability affects all SDC setups that incorporate admportal, potentially leading to unauthorized command execution within the system.

Technical Details of CVE-2019-12113

This section provides more technical insights into the vulnerability.

Vulnerability Description

An issue in ONAP SDNC before Dublin allows an authenticated user to execute arbitrary commands by manipulating a specific module parameter.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Versions: n/a

Exploitation Mechanism

The vulnerability can be exploited by executing the sla/printAsGv command with a crafted module parameter.

Mitigation and Prevention

Protecting systems from CVE-2019-12113 is crucial to maintaining security.

Immediate Steps to Take

Update ONAP SDNC to the Dublin release or a later version.
Monitor system logs for any suspicious activities.
Restrict access to vulnerable components.

Long-Term Security Practices

Conduct regular security audits and assessments.
Implement the principle of least privilege for user access.
Educate users on secure practices and awareness.

Patching and Updates

Apply patches and updates provided by ONAP promptly.