CVE-2022-22189 - Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

Back Back to CVE browser

HIGH

Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

Published Apr 14, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.23%

Description

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.

Affected products

Vendor Juniper Networks Product Contrail Service Orchestration Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.0 Patch v3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Contrail Service Orchestration

n/a

Version	Status	Constraints
6.0.0	affected	<6.0.0 Patch v3

Remediation

Vendor solution

The following software releases have been updated to resolve these specific issues: On-premises: Contrail Service Orchestration 6.0.0 Patch v3, 6.1.0, and all subsequent releases.

Weaknesses (2)

CWE-288

CWE-708

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27336
Advisory
https://kb.juniper.net/JSA69498
x_refsource_CONFIRMPermissions RequiredVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27336		Advisory
https://kb.juniper.net/JSA69498		x_refsource_CONFIRMPermissions RequiredVendor Advisory