CVE-2019-0073 — Incorrect Permission Assignment in Networks Junos OS

CWE-732 — Incorrect Permission AssignmentCWE-281 — Improper Preservation of Permissions4 documents4 sources
Severity
7.1HIGHNVD
CNA6.6
EPSS
0.0%
top 90.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OSJuniper Junos
Timeline
PublishedOct 9
Latest updateMay 24

Description

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os15.1X49 — 15.1X49-D180+6
▶NVDjuniper/junos7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-g4cp-h5rq-j4fr: The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions↗2022-05-24
▶
CVEList
Junos OS: PKI key pairs are exported with insecure file permissions↗2019-10-09
▶

📋Vendor Advisories

1
Juniper
CVE-2019-0073: The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow anot↗2019-10-09
▶
CVE-2019-0073 — Incorrect Permission Assignment | cvebase