An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.
References
| Link | Resource |
|---|---|
| https://kb.juniper.net/JSA69498 | Permissions Required Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Apr 2022, 14:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch2:*:*:*:*:*:* cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:-:*:*:*:*:*:* cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch1:*:*:*:*:*:* |
|
| CWE | CWE-708 |
NVD-CWE-Other |
| First Time |
Juniper
Juniper contrail Service Orchestration |
|
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 7.8 |
| References | (CONFIRM) https://kb.juniper.net/JSA69498 - Permissions Required, Vendor Advisory |
14 Apr 2022, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-14 16:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-22189
Mitre link : CVE-2022-22189
CVE.ORG link : CVE-2022-22189
JSON object : View
Products Affected
juniper
- contrail_service_orchestration
CWE
NVD-CWE-Other
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE-708Incorrect Ownership Assignment