Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HJuniper Contrail Service Orchestration
APPJuniper< 3.3.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2018-0038CRITICAL9.8PL ✓same product
Juniper Contrail Service Orchestration — zakodowane dane logowania do Cassandra
CVE-2018-0040CRITICAL9.8PL ✓same product
Juniper Contrail Service Orchestration — hardcoded certyfikaty i klucze kryptograficzne
CVE-2018-0042CRITICAL9.8PL ✓same product
Juniper CSO: logowanie haseł w plikach logów (information disclosure)
CVE-2022-22189HIGH7.3same product
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allow...
CVE-2022-22152HIGH7.7same product
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestratio...