CVE-2022-45932

HIGH

OpenDaylight < 0.16.5 - SQL Injection via Role Deletion API

Title source: llm
STIX 2.1

Description

A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory
https://jira.opendaylight.org/browse/AAA-239

Scores

CVSS v3 7.5
EPSS 0.0019
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (4)
linuxfoundation/opendaylight 0.15.0
linuxfoundation/opendaylight 0.15.6
linuxfoundation/opendaylight 0.16.0
linuxfoundation/opendaylight 0.16.4
Published Nov 27, 2022
Tracked Since Feb 18, 2026