CVE-2022-22152— Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-22152
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
保护机制失效
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Networks Contrail Service Orchestration 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks Contrail Service Orchestration是美国Juniper Networks公司的一个强大的软件平台。用于连接许多企业和多租户服务提供商解决方案。 Juniper Networks Contrail Service Orchestration 存在访问控制错误漏洞，该漏洞源于产品的REST API中不适当的访问限制。远程攻击者可以查看同一系统中其他租户的机密配置细节。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Contrail Service Orchestration | unspecified ~ 6.1.0 Patch 3 | - |
II. Public POCs for CVE-2022-22152
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-22152
请登录查看更多情报信息。
Same Patch Batch · Juniper Networks · 2022-01-19 · 27 CVEs total
| CVE-2022-22153 | 7.5 HIGH | SRX Series and MX Series with SPC3: A high percentage of fragments might lead to high late |
| CVE-2022-22180 | 7.5 HIGH | Junos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to proces |
| CVE-2022-22178 | 7.5 HIGH | Junos OS: MX and SRX series: Flowd core observed if the SIP ALG is enabled and a specific |
| CVE-2022-22159 | 7.5 HIGH | Junos OS: An attacker sending crafted packets can cause a traffic and CPU Denial of Servic |
| CVE-2022-22161 | 7.5 HIGH | Junos OS: MX104 might become unresponsive if the out-of-band management port receives a fl |
| CVE-2022-22175 | 7.5 HIGH | Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled |
| CVE-2022-22174 | 7.5 HIGH | Junos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon |
| CVE-2022-22173 | 7.5 HIGH | Junos OS: CRL failing to download causes a memory leak and ultimately a DoS |
| CVE-2022-22171 | 7.5 HIGH | Junos OS: Specific packets over VXLAN cause FPC reset |
| CVE-2022-22170 | 7.5 HIGH | Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset |
| CVE-2022-22176 | 7.4 HIGH | Junos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon re |
| CVE-2022-22163 | 7.4 HIGH | Junos OS: jdhcpd crashes upon receipt of a specific DHCPv6 packet |
| CVE-2022-22162 | 7.3 HIGH | Junos OS: A low privileged user can elevate their privileges to the ones of the highest pr |
| CVE-2022-22157 | 7.2 HIGH | Junos OS: SRX Series: Traffic classification vulnerability when 'no-syn-check' is enabled |
| CVE-2022-22167 | 7.2 HIGH | Junos OS: SRX Series: If no-syn-check is enabled, traffic classified as UNKNOWN gets permi |
| CVE-2022-22154 | 6.8 MEDIUM | Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing |
| CVE-2022-22172 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: An l2cpd memory leak can occur when specific LLDP packets a |
| CVE-2022-22168 | 6.5 MEDIUM | Junos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC |
| CVE-2022-22166 | 6.5 MEDIUM | Junos OS: An rpd core will occur if BGP update tracing is configured and an update contain |
| CVE-2022-22164 | 6.5 MEDIUM | Junos OS Evolved: Telnet service may be enabled when it is expected to be disabled. |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Contrail Service Orchestration
Same vendor: Juniper Networks
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33784
JSI Virtual Lightweight Collector: Default password is not r
Same weakness: CWE-693
- CVE-2026-26956
vm2: WASM Sandbox Escape (Node 25 only) - CVE-2026-24120
vm2: Sandbox Breakout Through Promise Species - CVE-2026-41316
ERB has an @_init deserialization guard bypass via def_modul - CVE-2026-41469
Beghelli Sicuro24 SicuroWeb Missing Content Security Policy - CVE-2026-40604
ClearanceKit: opfilter system extension can be suspended or
V. Comments for CVE-2022-22152
No comments yet