CVE-2018-1000616 - ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.

Back Back to CVE browser

CRITICAL

ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.

Published Jul 9, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 1.41%

Description

ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

http://gms.cl0udz.com/Openconfig_xxe.pdf
x_refsource_MISCExploitThird Party Advisory
https://gerrit.onosproject.org/#/c/18894/
x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
http://gms.cl0udz.com/Openconfig_xxe.pdf		x_refsource_MISCExploitThird Party Advisory
https://gerrit.onosproject.org/#/c/18894/		x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 9, 2018

Updated Sep 17, 2024

Reserved Jul 9, 2018

Link CVE-2018-1000616

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-1000616

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-1000616