What is GHSA-qm24-4869-99pj?

GHSA-qm24-4869-99pj is a security advisory published by GitHub Security Advisories with Critical severity. Opendaylight will authenticate any username and password combination

Which CVE IDs does GHSA-qm24-4869-99pj cover?

GHSA-qm24-4869-99pj covers the following CVE IDs: CVE-2015-1778. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qm24-4869-99pj?

GHSA-qm24-4869-99pj has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-qm24-4869-99pj?

GHSA-qm24-4869-99pj affects 1 product, including: maven/org.opendaylight.odlparent:opendaylight-karaf-resources:\u003c 0.2.3-Helium-SR3.

GHSA-qm24-4869-99pjCriticalCVSS 9.8

Opendaylight will authenticate any username and password combination

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

June 30, 2026

🔗 CVE IDs covered (1)

CVE-2015-1778 →

📋 Description

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination.

🎯 Affected products1

maven/org.opendaylight.odlparent:opendaylight-karaf-resources:< 0.2.3-Helium-SR3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2015-1778
http://www.openwall.com/lists/oss-security/2015/03/20/3
https://web.archive.org/web/20150510044305/https://git.opendaylight.org/gerrit/#/c/16307
https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BImportant.5D_CVE-2015-1778_OpenDaylight:_authentication_bypass
https://github.com/advisories/GHSA-qm24-4869-99pj