Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2017-10617

Contrail: XML External Entity (XXE) vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
juniper

Description

The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Juniper Networks Contrail

  • 2.2 to < 2.21.4affected
  • 3.0 to < 3.0.3.4affected
  • 3.1 to < 3.1.4.0affected
  • 3.2 to < 3.2.5.0affected

References