summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--osa/OSA-2019-008.rst35
1 files changed, 35 insertions, 0 deletions
diff --git a/osa/OSA-2019-008.rst b/osa/OSA-2019-008.rst
new file mode 100644
index 0000000..b0d3c34
--- /dev/null
+++ b/osa/OSA-2019-008.rst
@@ -0,0 +1,35 @@
+==============================================================================
+OSA-2019-008: ONAP Portal allows to retrieve password of currently active user
+==============================================================================
+
+**Date:** 2019-05-28
+
+**CVE:** CVE-2019-12122
+
+**Severity:** Important
+
+Affects
+-------
+
+* Portal: Dublin and earlier
+
+Description
+-----------
+
+Krzysztof Opasiak from Samsung reported a vulnerability in Portal. By executing a call to ONAPPORTAL/portalApi/loggedinUser an attacker who posses user's cookie may retrieve user's password from the database. All Portal setups are affected.
+
+Patches
+-------
+
+*`88682 <https://gerrit.onap.org/r/c/portal/+/88682>`_
+
+Credits
+-------
+
+* Krzysztof Opasiak from Samsung
+
+References
+----------
+
+* `OJSI-65 <https://jira.onap.org/browse/OJSI-65>`_
+* `CVE-2019-12122 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12122>`_