Log in Start free

Vulnerability · Published Oct 11, 2023 · Assigned by juniper

CVE-2023-44187Junos OS Evolved: 'file copy' CLI command can disclose password to shell users

Medium 5.9

In plain English

A medium-severity information exposure in Junos OS Evolved from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 92.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to view passwords supplied on the CLI command-line. These credentials can then be used to provide unauthorized access to the remote system. This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S7-EVO; * 21.1 versions 21.1R1-EVO and later; * 21.2 versions prior to 21.2R3-S5-EVO; * 21.3 versions prior to 21.3R3-S4-EVO; * 21.4 versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R2-EVO.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS Evolved 0 – before 20.4R3-S7-EVO21.1R1 – before 21.1*21.2 – before 21.2R3-S5-EVO21.3 – before 21.3R3-S4-EVO21.4 – before 21.4R3-S4-EVO22.1 – before 22.1R3-S2-EVO22.2 – before 22.2R2-EVO

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References