Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693.
Summary
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Contrail Service Orchestration | before 6.1.0 Patch 3 | 6.1.0 Patch 3 | Patch available | CNA |
- Contrail Service Orchestration VendorJuniper Affected before 6.1.0 Patch 3 Fixed in 6.1.0 Patch 3 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juniper:contrail_service_orchestration:*:*:*:*:*:*:*:* | up to 6.0.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:-:*:*:*:*:*:* | 6.1.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:patch1:*:*:*:*:*:* | 6.1.0 patch1 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:patch2:*:*:*:*:*:* | 6.1.0 patch2 | Vulnerable | Juniper |
- cpe:2.3:a:juniper:contrail_service_orchestration:*:*:*:*:*:*:*:* Versions up to 6.0.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:-:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:patch1:*:*:*:*:*:* Versions 6.1.0 patch1 Vulnerable ·Juniper
- cpe:2.3:a:juniper:contrail_service_orchestration:6.1.0:patch2:*:*:*:*:*:* Versions 6.1.0 patch2 Vulnerable ·Juniper
Remediation
- Fix · CNA Contrail Service Orchestration (Juniper Networks) Fixed in 6.1.0 Patch 3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22152
- 2026-10-03 Alias added: GHSA-hv5p-2fm6-37xc
References
Advisory 1
More Juniper Contrail Service Orchestration vulnerabilities
- TI-2018-00037 Contrail Service Orchestration: hardcoded cryptographic certificates and keys CVSS 3.0CRITICAL 9.8
- TI-2018-00039 Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an… CVSS 3.0CRITICAL 9.8
- TI-2018-00038 Contrail Service Orchestration: Hardcoded credentials for Keystone service. CVSS 3.0CRITICAL 9.8
- TI-2018-00036 Contrail Service Orchestration: Hardcoded credentials for Grafana service CVSS 3.0CRITICAL 9.8
- TI-2018-00035 Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra… CVSS 3.0CRITICAL 9.8
- TI-2022-06522 Authentication bypass in Juniper Contrail Service Orchestration CVSS 3.1HIGH 7.8
Sources
- CVE-2022-22152 · CVE Program
- CVE-2022-22152 · NVD
- FIRST EPSS
- GHSA-hv5p-2fm6-37xc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences