Read the docs
TI-2017-07783 Aliases CVE-2017-10617GHSA-f3v5-rq6c-674f

Contrail: XML External Entity (XXE) vulnerability

Priority LOW 27CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Why it matters now

EPSS 0.02278 83rd percentileScored 2026-11-07
Fix Fixed Contrail (Juniper Networks): 2.21.4, 3.0.3.4, 3.1.4.0 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperContrail2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.02.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0Patch availableCNA
  • Contrail VendorJuniper Affected 2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.0 Fixed in 2.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:juniper:contrail:*:*:*:*:*:*:*:*2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.0VulnerableJuniper
  • cpe:2.3:a:juniper:contrail:*:*:*:*:*:*:*:* Versions 2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.0 Vulnerable ·Juniper

Remediation

  • Fix · CNA Contrail (Juniper Networks) Fixed in 2.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Juniper Networks Contrail 2.21.4, 3.0.3.4 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-10617
  2. 2026-10-03 Alias added: GHSA-f3v5-rq6c-674f

References

Advisory 2

  • TI-2017-07782 Contrail: hard coded credentials CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences