PT-2021-19256 · Juniper Networks · Junos Evolved

Published 2021-10-19 · Updated 2022-10-25 · CVE-2021-31356

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions prior to 20.4R3-S1-EVO Juniper Networks Junos OS Evolved versions 21.1-EVO and 21.2-EVO

Description A command injection issue in command processing allows an attacker with authenticated CLI access to bypass access protections and execute arbitrary shell commands within the context of the current user. This issue enables an attacker to bypass command authorization restrictions and execute commands available to their assigned privilege level. For example, a restricted super-user could exploit this to execute any command available to an unrestricted admin user. This does not increase the user's privilege level but bypasses CLI command restrictions, allowing full access to the shell.

Recommendations For versions prior to 20.4R3-S1-EVO, update to version 20.4R3-S1-EVO or later. For versions 21.1-EVO and 21.2-EVO, there is no information about a newer version that contains a fix for this issue.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-31356

Affected Products

Junos Evolved

References · 3

• https://kb.juniper.net/JSA11221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31356 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31356 · Vendor Advisory