QID 44128

QID 44128: Juniper Network Operating System (Junos OS Evolved) CLI Command can Disclose Password to Shell Users (JSA73162)

Juniper Junos is the network operating system used in Juniper Networks hardware systems.

An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to view passwords supplied on the CLI command-line. These credentials can then be used to provide unauthorized access to the remote system.

This issue affects Juniper Networks Junos OS Evolved: all versions prior to 20.4R3-S7-EVO; 21.1 versions 21.1R1-EVO and later; 21.2 versions prior to 21.2R3-S5-EVO; 21.3 versions prior to 21.3R3-S4-EVO; 21.4 versions prior to 21.4R3-S4-EVO; 22.1 versions prior to 22.1R3-S2-EVO; 22.2 versions prior to 22.2R2-EVO.

Successful exploitation of this vulnerability can be used to provide unauthorized access to the remote system.

CVSS V3 rated as Medium - 5.5 severity.

CVSS V2 rated as Medium - 4.6 severity.

Solution

Vendor has released patch addressing the vulnerabilities, for more information please refer JSA73151

Vendor References

JSA73151 - supportportal.juniper.net/s/article/2023-10-Security-Bulletin-Junos-OS-Evolved-file-copy-CLI-command-can-disclose-password-to-shell-users-CVE-2023-44187?language=en_US

CVEs related to QID 44128

CVE-2023-44187 |

Software Advisories

Advisory ID	Software	Component	Link
JSA73151			supportportal.juniper.net/s/article/2023-10-Security-Bulletin-Junos-OS-Evolved-file-copy-CLI-command-can-disclose-password-to-shell-users-CVE-2023-44187?language=en_US

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].