CVE-2022-22152: Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
First published: Wed Jan 19 2022(Updated: )
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper Contrail Service Orchestration | <=6.0.0 | |
| Juniper Contrail Service Orchestration | =6.1.0 | |
| Juniper Contrail Service Orchestration | =6.1.0-patch1 | |
| Juniper Contrail Service Orchestration | =6.1.0-patch2 |
Remedy
The following software releases have been updated to resolve these specific issues: Juniper Networks Contrail Service Orchestration (CSO) 6.1.0 Patch 3, 6.2.0, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-22152?
CVE-2022-22152 is categorized as a critical vulnerability due to its potential for tenant information leakage.
How do I fix CVE-2022-22152?
To remediate CVE-2022-22152, update the Juniper Contrail Service Orchestration to the latest version or apply the necessary patches.
What systems are affected by CVE-2022-22152?
CVE-2022-22152 affects Juniper Contrail Service Orchestration versions up to 6.0.0 and 6.1.0, including its patch versions.
What type of vulnerability is CVE-2022-22152?
CVE-2022-22152 is classified as a Protection Mechanism Failure vulnerability in the REST API.
Can CVE-2022-22152 lead to data breaches?
Yes, CVE-2022-22152 can lead to unauthorized access to confidential configuration details across tenants, increasing the risk of data breaches.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/title
- agent/references
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/juniper
- canonical/juniper contrail service orchestration
- version/juniper contrail service orchestration/6.0.0
- version/juniper contrail service orchestration/6.1.0
- version/juniper contrail service orchestration/6.1.0-patch1
- version/juniper contrail service orchestration/6.1.0-patch2