An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a users cookie may retrieve that users password from the database. All Portal setups are affected.
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open_network_automation_platform | Onap | 3.0.0 (including) | 4.0.0 (excluding) |