CVE-2014-5035: Medium severity opendaylight vulnerability
The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5035?
CVE-2014-5035 has a medium severity rating due to its potential to facilitate unauthorized access to sensitive files.
How do I fix CVE-2014-5035?
To fix CVE-2014-5035, it is recommended to update OpenDaylight to a patched version that mitigates the XXE vulnerability.
What types of attacks are possible with CVE-2014-5035?
CVE-2014-5035 can allow remote attackers to perform unauthorized file reads or data exfiltration through XML external entity attacks.
Which version of OpenDaylight is affected by CVE-2014-5035?
CVE-2014-5035 affects OpenDaylight version 1.0.
Is there a workaround for CVE-2014-5035 if I cannot update software?
A possible workaround for CVE-2014-5035 is to disable the XML external entity parsing in the configuration of the affected system.