PT-2017-11412 · Juniper Networks · Contrail

Guillaume Teissier · Publicado 2017-10-13 · Atualizado 2023-01-30 · CVE-2017-10617

Mitre

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-10617

GHSA-WJP8-8QF6-VQMC

Produtos afetados

Contrail

Referências · 5

• 🔥 https://github.com/gteissier/CVE-2017-10617 · Exploit
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-10617 · Nota de Segurança
• https://kb.juniper.net/JSA10819 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-10617 · Aviso do Fabricante