CVE-2022-22152: Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22152?
CVE-2022-22152 is categorized as a critical vulnerability due to its potential for tenant information leakage.
How do I fix CVE-2022-22152?
To remediate CVE-2022-22152, update the Juniper Contrail Service Orchestration to the latest version or apply the necessary patches.
What systems are affected by CVE-2022-22152?
CVE-2022-22152 affects Juniper Contrail Service Orchestration versions up to 6.0.0 and 6.1.0, including its patch versions.
What type of vulnerability is CVE-2022-22152?
CVE-2022-22152 is classified as a Protection Mechanism Failure vulnerability in the REST API.
Can CVE-2022-22152 lead to data breaches?
Yes, CVE-2022-22152 can lead to unauthorized access to confidential configuration details across tenants, increasing the risk of data breaches.