PT-2022-2354 · Juniper Networks · Juniper Networks Contrail Service Orchestration

Published 2022-01-12 · Updated 2022-01-25 · CVE-2022-22152

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3

Description A Protection Mechanism Failure in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant to view confidential configuration details of another tenant on the same system. This includes obtaining information on another tenant's firewall configuration and access control policies, as well as other sensitive information. This exposure reduces the defense against malicious attacks or exploitation via additional undetermined vulnerabilities.

Recommendations For versions prior to 6.1.0 Patch 3, update to version 6.1.0 Patch 3 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation. Avoid using the REST API to access sensitive information until the issue is resolved.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2022-02663

CVE-2022-22152

Affected Products

Juniper Networks Contrail Service Orchestration

References · 7

• https://osv.dev/vulnerability/CVE-2022-22152 · Vendor Advisory
• https://kb.juniper.net/JSA11260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22152 · Security Note
• https://bdu.fstec.ru/vul/2022-02663 · Security Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11260&actp=METADATA · Note
• https://t.me/cvenotify/25793 · Telegram Post
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11260&actp=METADATA · Note