PT-2022-6707 · Juniper Networks · Junos Evolved

Published 2022-10-12 · Updated 2022-10-20 · CVE-2022-22248

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions prior to 20.4R3-S1-EVO Juniper Networks Junos OS Evolved version 21.1-EVO Juniper Networks Junos OS Evolved versions prior to 21.2R3-EVO Juniper Networks Junos OS Evolved versions prior to 21.3R2-EVO

Description The issue is related to an Incorrect Permission Assignment vulnerability in shell processing, allowing a low-privileged local user to modify configuration files. This could lead to the execution of arbitrary commands within the context of another user's session, potentially allowing an attacker to take complete control of the target system if the follow-on user is a high-privileged administrator. The vulnerability can be exploited with Junos CLI access.

Recommendations For versions prior to 20.4R3-S1-EVO, update to 20.4R3-S1-EVO or later. For version 21.1-EVO, update to a version after 21.1-EVO, such as 21.2R3-EVO or later. For versions prior to 21.2R3-EVO, update to 21.2R3-EVO or later. For versions prior to 21.3R2-EVO, update to 21.3R2-EVO or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-03565

CVE-2022-22248

Affected Products

Junos Evolved

References · 5

• https://kb.juniper.net/JSA69905 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03565 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22248 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22248 · Vendor Advisory
• https://vuldb.com/ru/?id.211130 · Note