CVE-2024-39532

published 2024-07-11

CVE-2024-39532: An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with…

Priority P4 27 medium 6.3 CVSS 3.1

AV L AC L PR H UI R S C C H I L A N

An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information.

When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information.
This issue affects:

Junos OS:

* All versions before 21.2R3-S9;
*

21.4 versions before 21.4R3-S9;

* 22.2 versions before 22.2R2-S1, 22.2R3;
* 22.3 versions before 22.3R1-S1, 22.3R2;

Junos OS Evolved:

* All versions before before 22.1R3-EVO;
* 22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO;
* 22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	< 21.2	21.2
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper_networks	junos_os	< 21.2R3-S9	21.2R3-S9
juniper_networks	junos_os	>= 21.4 < 21.4R3-S9	21.4R3-S9
juniper_networks	junos_os	>= 22.2 < 22.2R2-S1, 22.2R3	22.2R2-S1, 22.2R3
juniper_networks	junos_os	>= 22.3 < 22.3R1-S1, 22.3R2	22.3R1-S1, 22.3R2
juniper_networks	junos_os_evolved	< 22.1R3-EVO	22.1R3-EVO
juniper_networks	junos_os_evolved	>= 22.2-EVO < 22.2R2-S1-EVO, 22.2R3-EVO	22.2R2-S1-EVO, 22.2R3-EVO
juniper_networks	junos_os_evolved	>= 22.3-EVO < 22.3R1-S1-EVO, 22.3R2-EVO	22.3R1-S1-EVO, 22.3R2-EVO

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-532