SQL Injection Vulnerability in OpenDaylight's AAA Component

CVE-2022-45931

Summary

A SQL injection vulnerability exists in the AAA component of OpenDaylight, specifically in the deleteUser function of the UserStore class. When interacting with the API endpoint /auth/v1/users/, an attacker could manipulate input parameters to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the database. This issue affects versions of OpenDaylight AAA prior to 0.16.5 and necessitates prompt action to mitigate risks.

References