{"id":"GHSA-46hr-3cq3-mcgp","summary":"OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability","details":"An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.","aliases":["CVE-2024-46943"],"modified":"2026-09-10T03:50:55.951652640Z","published":"2024-09-16T14:37:28Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-09-16T20:16:16Z","nvd_published_at":"2024-09-15T23:15:11Z","cwe_ids":["CWE-285","CWE-287","CWE-520"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46943"},{"type":"WEB","url":"https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html"},{"type":"WEB","url":"https://doi.org/10.48550/arXiv.2408.16940"},{"type":"PACKAGE","url":"https://github.com/opendaylight/aaa"},{"type":"WEB","url":"https://lf-opendaylight.atlassian.net/browse/AAA-285"}],"affected":[{"package":{"name":"org.opendaylight.aaa:aaa-artifacts","ecosystem":"Maven","purl":"pkg:maven/org.opendaylight.aaa/aaa-artifacts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.19.3"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.13.0","0.13.1","0.13.10","0.13.11","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.2","0.14.3","0.14.4","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.1","0.16.10","0.16.11","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.16.7","0.16.8","0.16.9","0.17.0","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.19.0","0.19.1","0.19.2","0.19.3","0.3.0-Beryllium","0.3.1-Beryllium-SR1","0.3.2-Beryllium-SR2","0.3.3-Beryllium-SR3","0.3.4-Beryllium-SR4","0.4.0-Boron","0.4.1-Boron-SR1","0.4.2-Boron-SR2","0.4.3-Boron-SR3","0.4.4-Boron-SR4","0.5.0-Carbon","0.5.1-Carbon","0.5.2-Carbon","0.5.3-Carbon","0.5.4-Carbon","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-46hr-3cq3-mcgp/GHSA-46hr-3cq3-mcgp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}