CVE-2024-21615
Vulnerability from cvelistv5
Published
2024-04-12 14:55
Modified
2024-08-01 22:27
Severity ?
5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Summary
Junos OS and Junos OS Evolved: A low-privileged user can access confidential information
References
sirt@juniper.nethttps://supportportal.juniper.net/JSA75756
sirt@juniper.nethttps://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Impacted products
Juniper NetworksJunos OS
Juniper NetworksJunos OS Evolved
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T18:59:54.512566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-11T19:00:00.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.780Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://supportportal.juniper.net/JSA75756"
          },
          {
            "tags": [
              "technical-description",
              "x_transferred"
            ],
            "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.2R3-S7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "21.4R3-S5",
              "status": "affected",
              "version": "21.4",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1R3-S5",
              "status": "affected",
              "version": "22.1",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S3",
              "status": "affected",
              "version": "22.2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S2",
              "status": "affected",
              "version": "22.3",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3",
              "status": "affected",
              "version": "22.4",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R1-S2",
              "status": "affected",
              "version": "23.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.2R3-S7-EVO",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "21.3R3-S5-EVO",
              "status": "affected",
              "version": "21.3-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "21.4R3-S5-EVO",
              "status": "affected",
              "version": "21.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1R3-S5-EVO",
              "status": "affected",
              "version": "22.1-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S3-EVO",
              "status": "affected",
              "version": "22.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S2-EVO",
              "status": "affected",
              "version": "22.3-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-EVO",
              "status": "affected",
              "version": "22.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R1-S2",
              "status": "affected",
              "version": "23.2-EVO",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order for this issue to occur, netconf traceoptions needs to be enabled using the following configuration.\u003c/p\u003e\u003ctt\u003e\u0026nbsp; [system services netconf traceoptions]\u003c/tt\u003e"
            }
          ],
          "value": "In order for this issue to occur, netconf traceoptions needs to be enabled using the following configuration.\n\n\u00a0 [system services netconf traceoptions]"
        }
      ],
      "datePublic": "2024-04-10T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.\u003cbr\u003e\u003cbr\u003eOn all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.\u003cbr\u003e\u003cp\u003eThis issue affects:\u003c/p\u003e\u003cp\u003eJunos OS:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall versions before 21.2R3-S7,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 21.4 before 21.4R3-S5,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.1 before 22.1R3-S5,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S3,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S2,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R1-S2.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eJunos OS Evolved:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall versions before 21.2R3-S7-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 21.3 before 21.3R3-S5-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 21.4 before 21.4R3-S5-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.1 before 22.1R3-S5-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S3-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S2-EVO,\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R1-S2.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.\n\nOn all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.\nThis issue affects:\n\nJunos OS:\n\n\n\n  *  all versions before 21.2R3-S7,\u00a0\n\n  *  from 21.4 before 21.4R3-S5,\u00a0\n\n  *  from 22.1 before 22.1R3-S5,\u00a0\n\n  *  from 22.2 before 22.2R3-S3,\u00a0\n\n  *  from 22.3 before 22.3R3-S2,\u00a0\n\n  *  from 22.4 before 22.4R3,\u00a0\n\n  *  from 23.2 before 23.2R1-S2.\n\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n  *  all versions before 21.2R3-S7-EVO,\u00a0\n\n  *  from 21.3 before 21.3R3-S5-EVO,\u00a0\n\n  *  from 21.4 before 21.4R3-S5-EVO,\u00a0\n\n  *  from 22.1 before 22.1R3-S5-EVO,\u00a0\n\n  *  from 22.2 before 22.2R3-S3-EVO,\u00a0\n\n  *  from 22.3 before 22.3R3-S2-EVO,\n\n  *  from 22.4 before 22.4R3-EVO,\u00a0\n\n  *  from 23.2 before 23.2R1-S2."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJuniper SIRT is not aware of any malicious exploitation of this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-16T20:11:17.641Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA75756"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following software releases have been updated to resolve this specific issue:\u003c/p\u003e\u003cp\u003eJunos OS: 21.2R3-S7, 21.4R3-S5, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.4R1 and all subsequent releases.\u003c/p\u003e\u003cp\u003eJunos OS Evolved: 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.4R1-EVO and all subsequent releases.\u003c/p\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 21.2R3-S7, 21.4R3-S5, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.4R1 and all subsequent releases.\n\nJunos OS Evolved: 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.4R1-EVO and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA75756",
        "defect": [
          "1702241"
        ],
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-10T17:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Junos OS and Junos OS Evolved: A low-privileged user can access confidential information",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted hosts and networks to the NETCONF service.\u003c/p\u003e"
            }
          ],
          "value": "To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted hosts and networks to the NETCONF service."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-av217"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2024-21615",
    "datePublished": "2024-04-12T14:55:36.105Z",
    "dateReserved": "2023-12-27T19:38:25.709Z",
    "dateUpdated": "2024-08-01T22:27:35.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-21615\",\"sourceIdentifier\":\"sirt@juniper.net\",\"published\":\"2024-04-12T15:15:24.153\",\"lastModified\":\"2024-05-16T20:15:09.293\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.\\n\\nOn all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.\\nThis issue affects:\\n\\nJunos OS:\\n\\n\\n\\n  *  all versions before 21.2R3-S7,\u00a0\\n\\n  *  from 21.4 before 21.4R3-S5,\u00a0\\n\\n  *  from 22.1 before 22.1R3-S5,\u00a0\\n\\n  *  from 22.2 before 22.2R3-S3,\u00a0\\n\\n  *  from 22.3 before 22.3R3-S2,\u00a0\\n\\n  *  from 22.4 before 22.4R3,\u00a0\\n\\n  *  from 23.2 before 23.2R1-S2.\\n\\n\\n\\n\\n\\nJunos OS Evolved:\u00a0\\n\\n\\n\\n  *  all versions before 21.2R3-S7-EVO,\u00a0\\n\\n  *  from 21.3 before 21.3R3-S5-EVO,\u00a0\\n\\n  *  from 21.4 before 21.4R3-S5-EVO,\u00a0\\n\\n  *  from 22.1 before 22.1R3-S5-EVO,\u00a0\\n\\n  *  from 22.2 before 22.2R3-S3-EVO,\u00a0\\n\\n  *  from 22.3 before 22.3R3-S2-EVO,\\n\\n  *  from 22.4 before 22.4R3-EVO,\u00a0\\n\\n  *  from 23.2 before 23.2R1-S2.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de permisos predeterminados incorrectos en Juniper Networks Junos OS y Junos OS Evolved permite que un atacante local con pocos privilegios acceda a informaci\u00f3n confidencial en el sistema. En todas las plataformas Junos OS y Junos OS Evolved, cuando se configuran las opciones de seguimiento de NETCONF y un superusuario realiza acciones espec\u00edficas a trav\u00e9s de NETCONF, un usuario con pocos privilegios puede acceder a informaci\u00f3n confidencial que compromete la confidencialidad del sistema. Este problema afecta a: Junos OS: * todas las versiones anteriores a 21.2R3-S7, * desde 21.4 anterior a 21.4R3-S5, * desde 22.1 anterior a 22.1R3-S5, * desde 22.2 anterior a 22.2R3-S3, * desde 22.3 anterior a 22.3R3- S2, * de 22.4 antes de 22.4R3, * de 23.2 antes de 23.2R1-S2. Junos OS Evolved: * todas las versiones anteriores a 21.2R3-S7-EVO, * desde 21.3 anterior a 21.3R3-S5-EVO, * desde 21.4 anterior a 21.4R3-S5-EVO, * desde 22.1 anterior a 22.1R3-S5-EVO, * desde 22.2 antes de 22.2R3-S3-EVO, * desde 22.3 antes de 22.3R3-S2-EVO, * desde 22.4 antes de 22.4R3-EVO, * desde 23.2 antes de 23.2R1-S2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.3,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"references\":[{\"url\":\"https://supportportal.juniper.net/JSA75756\",\"source\":\"sirt@juniper.net\"},{\"url\":\"https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N\",\"source\":\"sirt@juniper.net\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.