CVE-2024-21615

Junos OS and Junos OS Evolved: A low-privileged user can access confidential information

Severity Score

5.1

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.

On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.
This issue affects:

Junos OS:

* all versions before 21.2R3-S7,

* from 21.4 before 21.4R3-S5,

* from 22.1 before 22.1R3-S5,

* from 22.2 before 22.2R3-S3,

* from 22.3 before 22.3R3-S2,

* from 22.4 before 22.4R3,

* from 23.2 before 23.2R1-S2.

Junos OS Evolved:

* all versions before 21.2R3-S7-EVO,

* from 21.3 before 21.3R3-S5-EVO,

* from 21.4 before 21.4R3-S5-EVO,

* from 22.1 before 22.1R3-S5-EVO,

* from 22.2 before 22.2R3-S3-EVO,

* from 22.3 before 22.3R3-S2-EVO,

* from 22.4 before 22.4R3-EVO,

* from 23.2 before 23.2R1-S2.

Una vulnerabilidad de permisos predeterminados incorrectos en Juniper Networks Junos OS y Junos OS Evolved permite que un atacante local con pocos privilegios acceda a información confidencial en el sistema. En todas las plataformas Junos OS y Junos OS Evolved, cuando se configuran las opciones de seguimiento de NETCONF y un superusuario realiza acciones específicas a través de NETCONF, un usuario con pocos privilegios puede acceder a información confidencial que compromete la confidencialidad del sistema. Este problema afecta a: Junos OS: * todas las versiones anteriores a 21.2R3-S7, * desde 21.4 anterior a 21.4R3-S5, * desde 22.1 anterior a 22.1R3-S5, * desde 22.2 anterior a 22.2R3-S3, * desde 22.3 anterior a 22.3R3- S2, * de 22.4 antes de 22.4R3, * de 23.2 antes de 23.2R1-S2. Junos OS Evolved: * todas las versiones anteriores a 21.2R3-S7-EVO, * desde 21.3 anterior a 21.3R3-S5-EVO, * desde 21.4 anterior a 21.4R3-S5-EVO, * desde 22.1 anterior a 22.1R3-S5-EVO, * desde 22.2 antes de 22.2R3-S3-EVO, * desde 22.3 antes de 22.3R3-S2-EVO, * desde 22.4 antes de 22.4R3-EVO, * desde 23.2 antes de 23.2R1-S2.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

Passive

System

Vulnerable | Subsequent

Confidentiality

High

Low

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-12-27 CVE Reserved
2024-04-12 CVE Published
2024-04-13 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-276: Incorrect Default Permissions

CAPEC

References (2)

URL	Tag	Source
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N	Technical Description

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://supportportal.juniper.net/JSA75756	2024-05-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				< 21.2R3-S7 Search vendor "Juniper Networks" for product "Junos OS" and version " < 21.2R3-S7"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 21.4 < 21.4R3-S5 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 21.4 < 21.4R3-S5"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 22.1 < 22.1R3-S5 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.1 < 22.1R3-S5"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 22.2 < 22.2R3-S3 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.2 < 22.2R3-S3"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 22.3 < 22.3R3-S2 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.3 < 22.3R3-S2"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 22.4 < 22.4R3 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.4 < 22.4R3"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Search vendor "Juniper Networks" for product "Junos OS"				>= 23.2 < 23.2R1-S2 Search vendor "Juniper Networks" for product "Junos OS" and version " >= 23.2 < 23.2R1-S2"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				< 21.2R3-S7-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " < 21.2R3-S7-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 21.3-EVO < 21.3R3-S5-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 21.3-EVO < 21.3R3-S5-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 21.4-EVO < 21.4R3-S5-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 21.4-EVO < 21.4R3-S5-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.1-EVO < 22.1R3-S5-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.1-EVO < 22.1R3-S5-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.2-EVO < 22.2R3-S3-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.2-EVO < 22.2R3-S3-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.3-EVO < 22.3R3-S2-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.3-EVO < 22.3R3-S2-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.4-EVO < 22.4R3-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.4-EVO < 22.4R3-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 23.2-EVO < 23.2R1-S2 Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 23.2-EVO < 23.2R1-S2"		en		Affected