PT-2023-3001 · Juniper Networks · Junos Evolved
Publicado
2023-04-12
·
Atualizado
2023-04-27
·
CVE-2023-28966
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Juniper Networks Junos OS Evolved versions prior to 20.4R3-S5-EVO
Juniper Networks Junos OS Evolved version 21.2 versions prior to 21.2R3-EVO
Juniper Networks Junos OS Evolved version 21.3 versions prior to 21.3R2-EVO
Description
The issue is caused by improper file and directory permissions on certain system files, allowing an attacker with access to these files and folders to inject CLI commands as root. A low-privileged local attacker with shell access can modify existing files or execute commands as root.
Recommendations
For versions prior to 20.4R3-S5-EVO, update to version 20.4R3-S5-EVO or later.
For version 21.2, update to version 21.2R3-EVO or later.
For version 21.3, update to version 21.3R2-EVO or later.
As a temporary workaround, consider restricting access to system files and folders to minimize the risk of exploitation.
Correção
Incorrect Default Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Junos Evolved