CVEvulnerability

CVE-2024-39544

5.1 MEDIUM Published 2024-10-11 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-10-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.1 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-276

Description

An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information. On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows a low-privileged user can access sensitive information compromising the confidentiality of the system. Junos OS Evolved:  * All versions before 20.4R3-S9-EVO,  * 21.2-EVO before 21.2R3-S7-EVO,  * 21.4-EVO before 21.4R3-S5-EVO,  * 22.1-EVO before 22.1R3-S5-EVO,  * 22.2-EVO before 22.2R3-S3-EVO,  * 22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO,  * 22.4-EVO before 22.4R3-EVO,  * 23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.

Affected configurations

• juniper junos os evolved (< 20.4) • juniper junos os evolved 20.4 • juniper junos os evolved 21.2 • juniper junos os evolved 21.4 • juniper junos os evolved 22.1 • juniper junos os evolved 22.2 • juniper junos os evolved 22.3 • juniper junos os evolved 22.4 • juniper junos os evolved 23.2

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References