How severe is CVE-2022-22189?

CVE-2022-22189 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-22189 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-22189?

CVE-2022-22189 primarily affects Juniper Contrail Service Orchestration. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-22189?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-22189 published?

CVE-2022-22189 was published on 2022-04-14 and last updated on 2026-06-17.

CVE-2022-22189

CVE-2022-22189 is a high-severity vulnerability in Juniper Contrail Service Orchestration with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-288.

Key facts

Severity: High (CVSS 3.x base score 7.3)
CVSS v2: 7.2
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-288
Affected product: Juniper Contrail Service Orchestration
Published: 2022-04-14
Last modified: 2026-06-17

Description

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.

Frequently asked questions

What is CVE-2022-22189?: An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.
How severe is CVE-2022-22189?: CVE-2022-22189 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-22189 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-22189?: CVE-2022-22189 primarily affects Juniper Contrail Service Orchestration. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-22189?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-22189 published?: CVE-2022-22189 was published on 2022-04-14 and last updated on 2026-06-17.

References

https://kb.juniper.net/JSA69498

Affected products (3)

cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:-:*:*:*:*:*:*
cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch1:*:*:*:*:*:*
cpe:2.3:a:juniper:contrail_service_orchestration:6.0.0:patch2:*:*:*:*:*:*

More vulnerabilities in Juniper Contrail Service Orchestration

CVE-2018-0042 — Critical (CVSS 9.8): Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure…
CVE-2018-0041 — Critical (CVSS 9.8): Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone…
CVE-2018-0040 — Critical (CVSS 9.8): Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and…
CVE-2018-0038 — Critical (CVSS 9.8): Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with…
CVE-2022-22152 — High (CVSS 7.7): A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows…
CVE-2018-0039 — Medium (CVSS 6.5): Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with…

All CVEs affecting Juniper Contrail Service Orchestration →

Other CWE-288 vulnerabilities

CVE-2026-53622 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's…
CVE-2026-48491 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in…
CVE-2026-48020 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity…
CVE-2026-20079 — Critical (CVSS 10.0): A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an…
CVE-2024-10081 — Critical (CVSS 10.0): CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.…
CVE-2024-2973 — Critical (CVSS 10.0): An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or…

Browse all CWE-288 vulnerabilities →