CVE-2025-29315: OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.
Published Mar 24, 2025 · Updated Mar 26, 2025
Affected packages
org.opendaylight.sfc:sfc-parent
- Ecosystem
- Maven
- Affected
- <= 0.10.4
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.opendaylight.sfc:sfc-parent
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology