{"cve":"CVE-2017-10617","nvd":{"published":"2017-10-13T17:29:00.817","modified":"2026-06-17T01:00:27.387","status":"Modified","description":"The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":5.0},"cwes":["CWE-611"],"references":["https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc","https://kb.juniper.net/JSA10819","https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc","https://kb.juniper.net/JSA10819"],"products":["juniper:contrail"],"source":"nvd","synced_at":"2026-10-19T20:46:01.145313090+00:00"},"epss":{"cve":"CVE-2017-10617","score":0.02278,"percentile":0.8312,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}