XML External Entity (XXE) Injection

Onos Controller is vulnerable to XML external entitiy (XXE) injection attack. It is possible because the application does not disable Document Type Definition (DTD) External Entities by default, allowing a malicious user to inject malicious external entities through XML files.