Juniper Contrail Service Orchestration vulnerabilities

7 CVEs affecting Juniper Contrail Service Orchestration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22189, published 2022-04-14.

More from Juniper.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-0040, published 2018-07-11. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized…
• CVE-2018-0042, published 2018-07-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability.
• CVE-2018-0041, published 2018-07-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to…
• CVE-2018-0038, published 2018-07-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers…
• CVE-2018-0039, published 2018-07-11. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers…
• CVE-2022-22152, published 2022-01-19. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another…
• CVE-2022-22189, published 2022-04-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication…