Lucene search

JuniperCVELIST:CVE-2018-0040

HistoryJul 11, 2018 - 6:00 p.m.

CVE-2018-0040 Contrail Service Orchestration: hardcoded cryptographic certificates and keys

2018-07-1118:00:00

CWE-321

juniper

www.cve.org

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services.

CNA Affected

[
  {
    "product": "Contrail Service Orchestration",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "4.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kb.juniper.net/JSA10872

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Related for CVELIST:CVE-2018-0040