CVE-2017-1000406

Published: Nov 30, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared (e.g. via restart).

Affected (1)

Products: Opendaylight: Karaf

Opendaylight

1 product

Karaf

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opendaylight Karaf	Version 0.6.1-carbon

Related CWEs

CWE-254

References (6)

http://seclists.org/oss-sec/2017/q4/320

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://git.opendaylight.org/gerrit/#/q/topic:AAA-151

Source: cve@mitre.org

Vendor Advisory

https://jira.opendaylight.org/browse/AAA-151

Source: cve@mitre.org

Issue TrackingVendor Advisory

http://seclists.org/oss-sec/2017/q4/320

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://git.opendaylight.org/gerrit/#/q/topic:AAA-151

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://jira.opendaylight.org/browse/AAA-151

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.