PT-2023-6146 · Juniper Networks · Junos Evolved+1

Published

2023-10-11

·

Updated

2023-10-19

·

CVE-2023-44201

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 20.4R3-S4 Juniper Networks Junos OS versions 21.1 prior to 21.1R3-S4 Juniper Networks Junos OS versions 21.2 prior to 21.2R3-S2 Juniper Networks Junos OS versions 21.3 prior to 21.3R2-S2, 21.3R3-S1 Juniper Networks Junos OS versions 21.4 prior to 21.4R2-S1, 21.4R3 Juniper Networks Junos OS Evolved versions prior to 20.4R3-S4-EVO Juniper Networks Junos OS Evolved versions 21.1 prior to 21.1R3-S2-EVO Juniper Networks Junos OS Evolved versions 21.2 prior to 21.2R3-S2-EVO Juniper Networks Junos OS Evolved versions 21.3 prior to 21.3R3-S1-EVO Juniper Networks Junos OS Evolved versions 21.4 prior to 21.4R2-S2-EVO
Description The issue is related to an incorrect permission assignment for a critical resource in Juniper Networks Junos OS and Junos OS Evolved. This allows a local authenticated attacker to read configuration changes without having the necessary permissions. When a user with the respective permissions commits a configuration change, a specific file is created that is readable even by users with no permissions to access the configuration. This can lead to privilege escalation as the user can read the password hash when a password change is being committed.
Recommendations For Juniper Networks Junos OS versions prior to 20.4R3-S4, update to version 20.4R3-S4 or later. For Juniper Networks Junos OS versions 21.1 prior to 21.1R3-S4, update to version 21.1R3-S4 or later. For Juniper Networks Junos OS versions 21.2 prior to 21.2R3-S2, update to version 21.2R3-S2 or later. For Juniper Networks Junos OS versions 21.3 prior to 21.3R2-S2, 21.3R3-S1, update to version 21.3R2-S2, 21.3R3-S1 or later. For Juniper Networks Junos OS versions 21.4 prior to 21.4R2-S1, 21.4R3, update to version 21.4R2-S1, 21.4R3 or later. For Juniper Networks Junos OS Evolved versions prior to 20.4R3-S4-EVO, update to version 20.4R3-S4-EVO or later. For Juniper Networks Junos OS Evolved versions 21.1 prior to 21.1R3-S2-EVO, update to version 21.1R3-S2-EVO or later. For Juniper Networks Junos OS Evolved versions 21.2 prior to 21.2R3-S2-EVO, update to version 21.2R3-S2-EVO or later. For Juniper Networks Junos OS Evolved versions 21.3 prior to 21.3R3-S1-EVO, update to version 21.3R3-S1-EVO or later. For Juniper Networks Junos OS Evolved versions 21.4 prior to 21.4R2-S2-EVO, update to version 21.4R2-S2-EVO or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-06853
CVE-2023-44201

Affected Products

Junos
Junos Evolved