CVE-2018-0019
published 2018-04-11CVE-2018-0019: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resulting in a…
PriorityP431medium5.9CVSS 3.0
AVNACHPRNUINSUCNINAH
EPSS
1.58%
72.8th percentile
A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resulting in a denial of service condition (DoS) for the SNMP subsystem. While a mib2d process crash can disrupt the network monitoring via SNMP, it does not impact routing, switching or firewall functionalities. SNMP is disabled by default on devices running Junos OS. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S7, 12.3R13; 12.3X48 versions prior to 12.3X48-D65; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D130; 15.1 versions prior to 15.1F2-S20, 15.1F6-S10, 15.1R7; 15.1X49 versions prior to 15.1X49-D130; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D471, 15.1X53-D472, 15.1X53-D58, 15.1X53-D66; 16.1 versions prior to 16.1R5-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D47; 16.1X70 versions prior to 16.1X70-D10; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R2-S6, 17.1R3;
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 12.1X46 < 12.1X46-D76 | 12.1X46-D76 |
| juniper_networks | junos_os | >= 12.3 < 12.3R12-S7, 12.3R13 | 12.3R12-S7, 12.3R13 |
| juniper_networks | junos_os | >= 12.3X48 < 12.3X48-D65 | 12.3X48-D65 |
| juniper_networks | junos_os | >= 14.1 < 14.1R9 | 14.1R9 |
| juniper_networks | junos_os | >= 14.1X53 < 14.1X53-D130 | 14.1X53-D130 |
| juniper_networks | junos_os | >= 15.1 < 15.1F2-S20, 15.1F6-S10, 15.1R7 | 15.1F2-S20, 15.1F6-S10, 15.1R7 |
| juniper_networks | junos_os | >= 15.1X49 < 15.1X49-D130 | 15.1X49-D130 |
| juniper_networks | junos_os | >= 15.1X53 < 15.1X53-D233, 15.1X53-D471, 15.1X53-D472, 15.1X53-D58, 15.1X53-D66 | 15.1X53-D233, 15.1X53-D471, 15.1X53-D472, 15.1X53-D58, 15.1X53-D66 |
| juniper_networks | junos_os | >= 16.1 < 16.1R5-S3, 16.1R7 | 16.1R5-S3, 16.1R7 |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2018-0019: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resultin
vendor_juniper·2018-04-11·CVSS 5.3
CVE-2018-0019 [MEDIUM] CWE-20 CVE-2018-0019: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resultin
CVE-2018-0019: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resulting in a denial of service condition (DoS) for the SNMP subsystem. While a mib2d process crash can disrupt the network monitoring via SNMP, it does not impact routing, switching or firewall functionalities. SNMP is disabled by default on devices running Junos OS. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S7, 12.3R13; 12.3X48 versions prior to 12.3X48-D65; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D130; 15.1 versions prior to 15.1F2-S20, 15.1F6-S10, 15.1R7; 15.1X49 versions prior to 15.1X49-D130; 15.1X53 versions prior to 15.1X53-D2
GHSA
GHSA-c6q9-4465-fh9v: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resultin
ghsa_unreviewed·2022-05-13
CVE-2018-0019 [MEDIUM] CWE-20 GHSA-c6q9-4465-fh9v: A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resultin
A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resulting in a denial of service condition (DoS) for the SNMP subsystem. While a mib2d process crash can disrupt the network monitoring via SNMP, it does not impact routing, switching or firewall functionalities. SNMP is disabled by default on devices running Junos OS. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S7, 12.3R13; 12.3X48 versions prior to 12.3X48-D65; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D130; 15.1 versions prior to 15.1F2-S20, 15.1F6-S10, 15.1R7; 15.1X49 versions prior to 15.1X49-D130; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D47
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019)
bugzilla·2018-09-17·CVSS 8.8
CVE-2018-14631 [HIGH] CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019)
CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019)
A flaw was found in Moodle. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
References:
https://moodle.org/mod/forum/discuss.php?d=376025
Upstream Patch:
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857
Discussion:
Created moodle tracking bugs for this issue:
Affects: epel-all [bug 1629951]
Affects: fedora-all [bug 1629950]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red
Bugzilla
CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019) [fedora-all]
bugzilla·2018-09-17·CVSS 8.8
CVE-2018-14631 [HIGH] CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019) [fedora-all]
CVE-2018-14631 moodle: boost theme - blog search GET parameter insufficiently filtered (MSA-18-0019) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
2018-04-11
Published