CVE-2018-0041 | BDVDB-2026-104191 Detail

Juniper NetworksContrail Service Orchestration

Description#

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone.

Impact#

Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

CWE-798 Use of Hard-coded Credentials

References#

https://kb.juniper.net/JSA10872

Exploit#

No public exploit known

History#

Version 12018-07-11Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.

Published

Published: 2018-07-11
Last modified: 2024-09-16

Vendor information

Vendor: Juniper Networks
Product: Contrail Service Orchestration

All Juniper Networks vulnerabilities

Score

9.8 Critical

EPSS

1.1%, Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 66.6.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Hard-coded Credentials

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
< 3.3.0
Fixed
3.3.0

Scoring System

CVSS v4.0

Not available

CVSS v3.1

Not available

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metric breakdown
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

CVSS v2

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).