Contrail Service Orchestration: Hardcoded credentials for Grafana service
CVE-2018-0039

6.5MEDIUM

Key Information:

Vendor
Juniper Networks
Status
Contrail Service Orchestration
Vendor
CVE Published:
11 July 2018

Badges

👾 Exploit Exists

Summary

Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.

Affected Version(s)

Contrail Service Orchestration < 4.0.0

References

https://kb.juniper.net/JSA10872
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.