Vulnerability · Published Jan 19, 2022 · Assigned by juniper

CVE-2022-22152Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface

High 7.7

In plain English

A high-severity security flaw in Contrail Service Orchestration from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Contrail Service Orchestration	unspecified – before 6.1.0 Patch 3

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://kb.juniper.net/JSA11260 x_refsource_CONFIRM