PT-2023-22060 · Juniper Networks · Junos Evolved

Published 2023-04-17 · Updated 2023-05-02 · CVE-2023-28978

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions prior to 20.4R3-S7-EVO Juniper Networks Junos OS Evolved version 21.1-EVO versions prior to 21.1R3-S4-EVO Juniper Networks Junos OS Evolved version 21.2-EVO versions prior to 21.2R3-S5-EVO Juniper Networks Junos OS Evolved version 21.4-EVO versions prior to 21.4R3-S1-EVO Juniper Networks Junos OS Evolved version 22.2-EVO versions prior to 22.2R3-EVO Juniper Networks Junos OS Evolved version 22.2-EVO versions prior to 22.2R2-S1-EVO

Description An Insecure Default Initialization of Resource issue allows an unauthenticated, network-based attacker to read certain confidential information. In the default configuration, it is possible to read confidential information about locally configured administrative users of the affected system.

Recommendations For versions prior to 20.4R3-S7-EVO, update to version 20.4R3-S7-EVO or later. For version 21.1-EVO, update to version 21.1R3-S4-EVO or later. For version 21.2-EVO, update to version 21.2R3-S5-EVO or later. For version 21.4-EVO, update to version 21.4R3-S1-EVO or later. For version 22.2-EVO, update to version 22.2R3-EVO or later. For version 22.2-EVO, update to version 22.2R2-S1-EVO or later.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2023-28978

Affected Products

Junos Evolved

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-28978 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28978 · Vendor Advisory
• https://supportportal.juniper.net/JSA70603 · Vendor Advisory