CVE-2018-0023 — Incorrect Default Permissions in Networks Junos Snapshot Administrator

CWE-276 — Incorrect Default Permissions10 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 74.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Juniper Networks Junos Snapshot AdministratorJuniper JsnapyJuniper Junos OS
Timeline
PublishedApr 11
Latest updateDec 18

Description

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who d…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDjuniper/jsnapy< 1.3.0
▶PyPIjuniper/jsnapy< 1.3.0

🔴Vulnerability Details

3
OSV
JSNAPy allows unprivileged local users to alter files under the directory↗2018-07-12
▶
GHSA
JSNAPy allows unprivileged local users to alter files under the directory↗2018-07-12
▶
OSV
CVE-2018-0023: JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github↗2018-04-11
▶

💥Exploits & PoCs

5
Exploit-DB
MiniShare 1.4.1 - 'HEAD/POST' Remote Buffer Overflow↗2018-12-18
▶
Exploit-DB
VBScript - 'rtFilter' Out-of-Bounds Read↗2018-11-30
▶
Exploit-DB
VBScript - 'OLEAUT32!VariantClear' and 'scrrun!VBADictionary::put_Item' Use-After-Free↗2018-11-30
▶
Exploit-DB
Easy File Sharing Web Server 7.2 - Stack Buffer Overflow↗2018-04-18
▶
Exploit-DB
ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions↗2018-03-05
▶

📋Vendor Advisories

1
Juniper
CVE-2018-0023: JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and s↗2018-04-11
▶