Lucene search

[email protected]CVE-2022-22189

HistoryApr 14, 2022 - 4:15 p.m.

CVE-2022-22189

2022-04-1416:15:08

CWE-288

CWE-708

[email protected]

web.nvd.nist.gov

cve-2022-22189

juniper networks

contrail service orchestration

cso

vulnerability

permissions

authentication

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.

Affected configurations

NVD

Node

junipercontrail_service_orchestrationMatch6.0.0-

junipercontrail_service_orchestrationMatch6.0.0patch1

junipercontrail_service_orchestrationMatch6.0.0patch2

CPENameOperatorVersion
juniper:contrail_service_orchestrationjuniper contrail service orchestrationeq6.0.0

CPE	Name	Operator	Version
juniper:contrail_service_orchestration	juniper contrail service orchestration	eq	6.0.0

CNA Affected

[
  {
    "platforms": [
      "On-premises"
    ],
    "product": "Contrail Service Orchestration",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "6.0.0 Patch v3",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Contrail Service Orchestration",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "6.0.0",
        "status": "unaffected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kb.juniper.net/JSA69498

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-22189

nvd1 cvelist1 prion1