CVE-2018-0041 - Vulnerability Details - OpenCVE

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00487.

Key SSVC decision points have not yet been added.

Vendors	Products
Juniper	Contrail Service Orchestration

Configuration 1 [-]

cpe:2.3:a:juniper:contrail_service_orchestration:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2018-0865	Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone.

Fixes

Solution

This issue is fixed in Contrail Service Orchestration 3.3.0 and subsequent releases.

Workaround

Limit access to the CSO environment to only trusted networks and hosts.

References

Link	Providers
https://kb.juniper.net/JSA10872

History

No history.

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2018-07-11T18:00:00Z

Updated: 2024-09-16T23:25:36.406Z

Reserved: 2017-11-16T00:00:00

Link: CVE-2018-0041

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-07-11T18:29:00.950

Modified: 2024-11-21T03:37:24.793

Link: CVE-2018-0041

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Contrail Service Orchestration", "vendor": "Juniper Networks", "versions": [{"lessThan": "3.3.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2018-07-11T00:00:00", "descriptions": [{"lang": "en", "value": "Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials.", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-07-11T17:57:01", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://kb.juniper.net/JSA10872"}], "solutions": [{"lang": "en", "value": "This issue is fixed in Contrail Service Orchestration 3.3.0 and subsequent releases."}], "source": {"advisory": "JSA10872", "defect": ["CXU-5819"], "discovery": "INTERNAL"}, "title": "Contrail Service Orchestration: Hardcoded credentials for Keystone service.", "workarounds": [{"lang": "en", "value": "Limit access to the CSO environment to only trusted networks and hosts."}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2018-07-11T16:00:00.000Z", "ID": "CVE-2018-0041", "STATE": "PUBLIC", "TITLE": "Contrail Service Orchestration: Hardcoded credentials for Keystone service."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Contrail Service Orchestration", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "3.3.0"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-798: Use of Hard-coded Credentials."}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA10872", "refsource": "CONFIRM", "url": "https://kb.juniper.net/JSA10872"}]}, "solution": [{"lang": "en", "value": "This issue is fixed in Contrail Service Orchestration 3.3.0 and subsequent releases."}], "source": {"advisory": "JSA10872", "defect": ["CXU-5819"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "Limit access to the CSO environment to only trusted networks and hosts."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:14:16.669Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kb.juniper.net/JSA10872"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2018-0041", "datePublished": "2018-07-11T18:00:00Z", "dateReserved": "2017-11-16T00:00:00", "dateUpdated": "2024-09-16T23:25:36.406Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:juniper:contrail_service_orchestration:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD032452-27D1-410B-BCF3-AB21D6055CCD", "versionEndExcluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone."}, {"lang": "es", "value": "Las versiones de Juniper Networks Contrail Service Orchestration anteriores a la 3.3.0 emplean credenciales embebidas para acceder al servicio Keystone. Estas credenciales permiten que atacantes en la red accedan de forma no autorizada a la informaci\u00f3n almacenada en Keystone."}], "id": "CVE-2018-0041", "lastModified": "2024-11-21T03:37:24.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "sirt@juniper.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-11T18:29:00.950", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10872"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10872"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "sirt@juniper.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}