CVE-2018-0040criticalCWE-321

CVE-2018-0040: fallo crítico en Juniper Networks Contrail Service Orchestration

Contrail Service Orchestration: hardcoded cryptographic certificates and keys

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Contrail Service Orchestration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 1.4%
Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Juniper Networks · Contrail Service Orchestration
CVEs relacionadas — Juniper Networks Contrail Service Orchestration

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-0041CRITICALContrail Service Orchestration: Hardcoded credentials for Keystone service.EPSS 1.1%CVE-2018-0039MEDIUMContrail Service Orchestration: Hardcoded credentials for Grafana serviceEPSS 1.0%CVE-2022-22152HIGHContrail Service Orchestration: Tenants able to see other tenants policies via REST API interfaceEPSS 0.8%CVE-2022-22189HIGHContrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authenticationEPSS 0.2%