CVE-2018-0039

Contrail Service Orchestration: Hardcoded credentials for Grafana service

State: Published
Severity: 6.5 Medium
Published: Jul 11, 2018
Updated: Sep 16, 2024
Reserved: Nov 16, 2017

Description

Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.

Scores

CVSS	Score	Vector	Source
3.0	6.5 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	juniper

Weaknesses

CWE-798 Use of Hard-coded Credentials
CWE-561 Dead Code

Affected Products

Product	Versions
Contrail Service OrchestrationJuniper Networks	before 4.0.0Affected

References

https://kb.juniper.net/JSA10872

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.