CVE-2022-22189CWE-288CWE-708

Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

High · published April 14, 2022

CVSS v3.1
7.3
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-708 · Incorrect Ownership Assignment
Published
2022-04-14T15:50Z
EPSS history
Timeline
  • 14 APR 15:50Z
    Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication
    cvelistv5