Medium severity · published Oct 13, 2017
CVE-2017-10617
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files
5.0
CVSS
2.3%
EPSS
No
On KEV
Description
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Contrail · Juniper
2.2 before 2.21.4; 3.0 before 3.0.3.4; 3.1 before 3.1.4.0; 3.2 before 3.2.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10617
Third Party Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc
Vendor Advisory
https://kb.juniper.net/JSA10819
More from Contrail
5.3
CVE-2017-10616
The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials