CVE-2018-0039mediumCWE-561CWE-798

CVE-2018-0039: fallo de gravedad media en Juniper Networks Contrail Service Orchestration

Contrail Service Orchestration: Hardcoded credentials for Grafana service

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Contrail Service Orchestration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 1.0%
Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Juniper Networks · Contrail Service Orchestration
CVEs relacionadas — Juniper Networks Contrail Service Orchestration

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-0040CRITICALContrail Service Orchestration: hardcoded cryptographic certificates and keysEPSS 1.4%CVE-2018-0041CRITICALContrail Service Orchestration: Hardcoded credentials for Keystone service.EPSS 1.1%CVE-2022-22152HIGHContrail Service Orchestration: Tenants able to see other tenants policies via REST API interfaceEPSS 0.8%CVE-2022-22189HIGHContrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authenticationEPSS 0.2%