CVE-2017-10616 Contrail: hard coded credentials
Hardcoded credentials in the ifmap service allow attackers to access sensitive data in Juniper Contrail deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-10616?
CVE-2017-10616 is a medium-severity vulnerability in Juniper Networks Contrail, published on 13 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Weakness: CWE-798
Which versions are affected by CVE-2017-10616?
It affects 1 product.
Products include Juniper Contrail.
How do I fix CVE-2017-10616?
No fix has been published for CVE-2017-10616 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-10616 being exploited?
There is no known exploitation of CVE-2017-10616 in the wild and no public exploit code.
Other vulnerabilities in Juniper Networks Contrail
Sources
Also known as GHSA-hhp8-q7c4-jx53.