PT-2017-11412 · Juniper Networks · Contrail

Guillaume Teissier · CVE-2017-10617 · Published 2017-10-13 · Updated 2023-01-30

Mitre

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-10617

GHSA-WJP8-8QF6-VQMC

Affected Products

Contrail

References · 5

• 🔥 https://github.com/gteissier/CVE-2017-10617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10617 · Security Note
• https://kb.juniper.net/JSA10819 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10617 · Vendor Advisory
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc · Note