Critical severity · published Sep 30, 2021
CVE-2020-18685
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or…
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Floodlight · Atlassian
through 1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-18685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-18685
Exploit
https://drive.google.com/open?id=1oIt6jViGxLALUkLVELsQpC26MJYFZt2U
More from Floodlight
9.8
CVE-2020-18684
Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number
9.8
CVE-2020-18683
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling
5.9
CVE-2015-6569
Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and…