Log in Start free

Vulnerability · Published Jul 11, 2024 · Assigned by juniper

CVE-2024-39532Junos OS and Junos OS Evolved: Confidential information in logs can be accessed by another user

Medium 6.3

In plain English

A medium-severity sensitive data in logs in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 95.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information. When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information. This issue affects: Junos OS: * All versions before 21.2R3-S9; * 21.4 versions before 21.4R3-S9; * 22.2 versions before 22.2R2-S1, 22.2R3; * 22.3 versions before 22.3R1-S1, 22.3R2; Junos OS Evolved: * All versions before before 22.1R3-EVO; * 22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 0 – before 21.2R3-S921.4 – before 21.4R3-S922.2 – before 22.2R2-S1, 22.2R322.3 – before 22.3R1-S1, 22.3R2
Juniper Networks Junos OS Evolved 0 – before 22.1R3-EVO22.2-EVO – before 22.2R2-S1-EVO, 22.2R3-EVO22.3-EVO – before 22.3R1-S1-EVO, 22.3R2-EVO

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

References