opendaylight/sfc · Security
OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
- GHSA ID
- GHSA-x65v-g96x-c6gw
- CVE ID
- CVE-2025-29315
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.
CWEs
- CWE-284 · Improper Access Control