CVE-2022-22152CWE-693

Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface

High · published January 19, 2022

CVSS v3.1
7.7
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00780 · 55.5th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2022-01-19T00:20Z
EPSS history
Timeline
  • 19 JAN 00:20Z
    Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
    cvelistv5