Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HJuniper Contrail Service Orchestration
APPJuniper< 3.3.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2018-0040CRITICAL9.8PL ✓same product
Juniper Contrail Service Orchestration — hardcoded certyfikaty i klucze kryptograficzne
CVE-2018-0041CRITICAL9.8PL ✓same product
Hardcoded credentials w Juniper Contrail Service Orchestration — nieautoryzowany dostęp do Keystone
CVE-2018-0042CRITICAL9.8PL ✓same product
Juniper CSO: logowanie haseł w plikach logów (information disclosure)
CVE-2022-22189HIGH7.3same product
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allow...
CVE-2022-22152HIGH7.7same product
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestratio...