CVE-2022-22189: Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22189?
CVE-2022-22189 has a high severity rating due to its potential for local privilege escalation.
How do I fix CVE-2022-22189?
To mitigate CVE-2022-22189, apply the latest patches provided by Juniper for Contrail Service Orchestration version 6.0.0.
Who is affected by CVE-2022-22189?
CVE-2022-22189 affects users of Juniper Networks Contrail Service Orchestration versions 6.0.0, 6.0.0-patch1, and 6.0.0-patch2.
What kind of vulnerability is CVE-2022-22189?
CVE-2022-22189 is classified as an Incorrect Ownership Assignment vulnerability.
Can CVE-2022-22189 be exploited remotely?
CVE-2022-22189 requires local authentication, meaning it cannot be exploited remotely.