{"id":"CVE-2024-46942","aliases":["EUVD-2024-2814","GHSA-hv38-h5pj-c96j"],"status":"published","title":"OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00443,"percentile":0.38993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2024-09-15T00:00:00Z","modified":"2026-06-17T07:56:14Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opendaylight.mdsal:mdsal-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opendaylight.mdsal:mdsal-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.0.1"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","13.0.0","13.0.1","2.0.0-Beryllium","2.0.1-Beryllium-SR1","2.0.2-Beryllium-SR2","2.0.3-Beryllium-SR3","2.0.4-Beryllium-SR4","2.1.0-Boron","2.1.1-Boron-SR1","2.1.2-Boron-SR2","2.1.3-Boron-SR3","2.1.4-Boron-SR4","2.2.0-Carbon","2.2.1-Carbon","2.2.2-Carbon","2.2.3-Carbon","2.2.4-Carbon","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","7.0.0","7.0.1","7.0.10","7.0.11","7.0.12","7.0.13","7.0.14","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.0.9","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]}],"products":[{"vendor":"opendaylight","product":"md-sal"},{"vendor":"opendaylight","product":"model-driven_service_abstraction_layer"}],"references":[{"url":"https://lf-opendaylight.atlassian.net/browse/MDSAL-869","tags":["Issue Tracking","Vendor Advisory","web"]},{"url":"https://doi.org/10.48550/arXiv.2408.16940","tags":["Technical Description","web"]},{"url":"https://docs.opendaylight.org/en/latest/release-notes/projects/mdsal.html","tags":["Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46942","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hv38-h5pj-c96j"},{"url":"https://github.com/opendaylight/mdsal","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-46942","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","status":"published","published":"2024-09-15T00:00:00Z","modified":"2025-03-14T18:20:02.943Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-2814","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","status":"published","published":"2024-09-15T00:00:00Z","modified":"2025-03-14T18:20:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:53:02.719002Z"}],"ghsa":[{"id":"GHSA-hv38-h5pj-c96j","title":"OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","status":"published","published":"2024-09-16T14:37:28Z","modified":"2024-11-18T16:27:14Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2024-46942","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","status":"published","published":"2024-09-15T23:15:11.033Z","modified":"2026-06-17T07:56:14.037Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:10:26.717759Z"}],"osv":[{"id":"GHSA-hv38-h5pj-c96j","title":"OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries","description":"In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.","status":"published","published":"2024-09-16T14:37:28Z","modified":"2024-11-26T05:25:38.527377Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}