GitHub Advisoryadvisory · PyPI

GHSA-qc55-vm3j-74gp JSNAPy allows unprivileged local users to alter files under the directory

HIGH Published 2018-07-12 Modified 2024-09-24 Official page ↗
Aliases
CVE-2018-0023
Ecosystem
PyPI
Packages
jsnapy
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-276
Reviewed
2020-06-16

Affected packages

• PyPI jsnapy: < 1.3.0 → fixed in 1.3.0

Description

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.

Related

Alias · CVE (1)

  • CVE-2018-0023 JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References