CVE-2022-45930

HIGH

OpenDaylight < 0.16.5 - SQL Injection via Domain Deletion API

Title source: llm
STIX 2.1

Description

A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is affected for the /auth/v1/domains/ API interface.

References (2)

Core 2
Core References
Exploit, Patch, Third Party Advisory
https://jira.opendaylight.org/browse/AAA-240

Scores

CVSS v3 7.5
EPSS 0.0020
EPSS Percentile 42.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (4)
linuxfoundation/opendaylight 0.15.0
linuxfoundation/opendaylight 0.15.6
linuxfoundation/opendaylight 0.16.0
linuxfoundation/opendaylight 0.16.4
Published Nov 27, 2022
Tracked Since Feb 18, 2026