CVE-2017-10616 — MEDIUM (5.3)

Vulnerability Description

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Juniper	Contrail	2.2

Related Weaknesses (CWE)

CWE-798

References

https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-Third Party Advisory
https://kb.juniper.net/JSA10819Vendor Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-Third Party Advisory
https://kb.juniper.net/JSA10819Vendor Advisory

FAQ

What is CVE-2017-10616?

CVE-2017-10616 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior t...

How severe is CVE-2017-10616?

CVE-2017-10616 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-10616?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Contrail.