From c2e97ee8d627ba3b8dc23cb3ea7d9758d2d1ed86 Mon Sep 17 00:00:00 2001
From: Krzysztof Opasiak <k.opasiak@samsung.com>
Date: Tue, 28 May 2019 13:24:49 +0200
Subject: Issue OSA for OJSI-65

Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Change-Id: I34aa748456035051990d44007b1e8cb324fc9a19
---
 osa/OSA-2019-008.rst | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 osa/OSA-2019-008.rst

diff --git a/osa/OSA-2019-008.rst b/osa/OSA-2019-008.rst
new file mode 100644
index 0000000..b0d3c34
--- /dev/null
+++ b/osa/OSA-2019-008.rst
@@ -0,0 +1,35 @@
+==============================================================================
+OSA-2019-008: ONAP Portal allows to retrieve password of currently active user
+==============================================================================
+
+**Date:** 2019-05-28
+
+**CVE:** CVE-2019-12122
+
+**Severity:** Important
+
+Affects
+-------
+
+* Portal: Dublin and earlier
+
+Description
+-----------
+
+Krzysztof Opasiak from Samsung reported a vulnerability in Portal. By executing a call to ONAPPORTAL/portalApi/loggedinUser an attacker who posses user's cookie may retrieve user's password from the database. All Portal setups are affected.
+
+Patches
+-------
+
+*`88682 <https://gerrit.onap.org/r/c/portal/+/88682>`_
+
+Credits
+-------
+
+* Krzysztof Opasiak from Samsung
+
+References
+----------
+
+* `OJSI-65 <https://jira.onap.org/browse/OJSI-65>`_
+* `CVE-2019-12122 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12122>`_
-- 
cgit 1.2.3-korg