SB2022011708 - Improper access control in Juniper Networks Contrail Service Orchestration

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022011708

SB2022011708 - Improper access control in Juniper Networks Contrail Service Orchestration

Published: January 17, 2022

Security Bulletin ID SB2022011708
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper access control (CVE-ID: CVE-2022-22152)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the REST API. A remote authenticated user can view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities.


Remediation

Install update from vendor's website.

References