An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.
References
Link | Resource |
---|---|
https://kb.juniper.net/JSA69498 | Permissions Required Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Apr 2022, 14:25
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://kb.juniper.net/JSA69498 - Permissions Required, Vendor Advisory | |
CWE | CWE-288 |
NVD-CWE-Other |
CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 7.8 |
CPE | cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:-:*:*:*:*:*:* cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch1:*:*:*:*:*:* cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch2:*:*:*:*:*:* |
14 Apr 2022, 16:38
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-04-14 16:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-22189
Mitre link : CVE-2022-22189
CVE.ORG link : CVE-2022-22189
JSON object : View
Products Affected
juniper
- contrail_service_orchestration
CWE
NVD-CWE-Other
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE-708Incorrect Ownership Assignment