CVE-2022-22189: Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

Published Apr 14, 2022
·
Updated

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.

Affected Software

3 affected components
Juniper Contrail Service Orchestration=6.0.0
Juniper Contrail Service Orchestration=6.0.0-patch1
Juniper Contrail Service Orchestration=6.0.0-patch2

Remediation

Information

The following software releases have been updated to resolve these specific issues: On-premises: Contrail Service Orchestration 6.0.0 Patch v3, 6.1.0, and all subsequent releases.

Event History

Apr 14, 2022
CVE Published
via MITRE·03:50 PM
Data Sourced
via MITRE·03:50 PM
RemedyDescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2022-22189?

CVE-2022-22189 has a high severity rating due to its potential for local privilege escalation.

2

How do I fix CVE-2022-22189?

To mitigate CVE-2022-22189, apply the latest patches provided by Juniper for Contrail Service Orchestration version 6.0.0.

3

Who is affected by CVE-2022-22189?

CVE-2022-22189 affects users of Juniper Networks Contrail Service Orchestration versions 6.0.0, 6.0.0-patch1, and 6.0.0-patch2.

4

What kind of vulnerability is CVE-2022-22189?

CVE-2022-22189 is classified as an Incorrect Ownership Assignment vulnerability.

5

Can CVE-2022-22189 be exploited remotely?

CVE-2022-22189 requires local authentication, meaning it cannot be exploited remotely.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203