CVE-2022-22152: juniper contrail service orchestration

csirt@kutim:~/threat-intel/cve/CVE-2022-22152

CVSS 6.5 · Medium EPSS 0,78%

Kerentanan Protection Mechanism Failure pada juniper contrail service orchestration. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.

Rincian

Terbit di NVD: 19 Januari 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-693: Protection Mechanism Failure
EPSS (30 hari): 0,78% peluang dieksploitasi; lebih tinggi dari 54,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
juniper	contrail service orchestration	Semua versi hingga 6.0.0
juniper	contrail service orchestration	Versi 6.1.0
juniper	contrail service orchestration	Versi 6.1.0 patch1
juniper	contrail service orchestration	Versi 6.1.0 patch2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://kb.juniper.net/JSA11260 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.