CVE-2024-21615
published 2024-04-12CVE-2024-21615: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential…
PriorityP423medium5CVSS 3.1
AVLACLPRLUIRSUCHINAN
EPSS
0.15%
4.8th percentile
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.
On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.
This issue affects:
Junos OS:
* all versions before 21.2R3-S7,
* from 21.4 before 21.4R3-S5,
* from 22.1 before 22.1R3-S5,
* from 22.2 before 22.2R3-S3,
* from 22.3 before 22.3R3-S2,
* from 22.4 before 22.4R3,
* from 23.2 before 23.2R1-S2.
Junos OS Evolved:
* all versions before 21.2R3-S7-EVO,
* from 21.3 before 21.3R3-S5-EVO,
* from 21.4 before 21.4R3-S5-EVO,
* from 22.1 before 22.1R3-S5-EVO,
* from 22.2 before 22.2R3-S3-EVO,
* from 22.3 before 22.3R3-S2-EVO,
* from 22.4 before 22.4R3-EVO,
* from 23.2 before 23.2R1-S2.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | < 21.2 | 21.2 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | junos_os_evolved | < 21.2 | 21.2 |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper_networks | junos_os | < 21.2R3-S7 | 21.2R3-S7 |
| juniper_networks | junos_os | >= 21.4 < 21.4R3-S5 | 21.4R3-S5 |
| juniper_networks | junos_os | >= 22.1 < 22.1R3-S5 | 22.1R3-S5 |
| juniper_networks | junos_os | >= 22.2 < 22.2R3-S3 | 22.2R3-S3 |
| juniper_networks | junos_os | >= 22.3 < 22.3R3-S2 | 22.3R3-S2 |
| juniper_networks | junos_os | >= 22.4 < 22.4R3 | 22.4R3 |
| juniper_networks | junos_os | >= 23.2 < 23.2R1-S2 | 23.2R1-S2 |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2024-21615: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access con
vendor_juniper·2024-04-12·CVSS 5.0
CVE-2024-21615 [MEDIUM] CWE-276 CVE-2024-21615: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access con
CVE-2024-21615: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.
On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.
This issue affects:
Junos OS:
* all versions before 21.2R3-S7,
* from 21.4 before 21.4R3-S5,
* from 22.1 before 22.1R3-S5,
* from 22.2 before 22.2R3-S3,
* from 22.3 before 22.3R3-S2,
* from 22.4 before 22.4R3,
* from 23.2 before 23.2R1-S2.
Junos OS Evolved:
* all versions before 21.2R3-S7-EVO,
* from 21.3 before 21.3R3-S5-EVO,
GHSA
GHSA-fhrq-x65x-r754: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access con
ghsa_unreviewed·2024-04-12
CVE-2024-21615 [MEDIUM] CWE-276 GHSA-fhrq-x65x-r754: An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access con
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.
On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.
This issue affects:
Junos OS:
* all versions before 21.2R3-S7,
* from 21.4 before 21.4R3-S5,
* from 22.1 before 22.1R3-S5,
* from 22.2 before 22.2R3-S3,
* from 22.3 before 22.3R3-S2,
* from 22.4 before 22.4R3,
* from 23.2 before 23.2R1-S2.
Junos OS Evolved:
* all versions before 21.2R3-S7-EVO,
* from 21.3 before 21.3R3-S5-EVO,
* from 21.4 be
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-12
Published