Information disclosure in Juniper Junos OS Evolved
CVE-2023-44187
An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to view passwords supplied on the CLI command-line. These credentials can then be used to provide unauthorized access to the remote system. This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S7-EVO; * 21.1 versions 21.1R1-EVO and later; * 21.2 versions prior to 21.2R3-S5-EVO; * 21.3 versions prior to 21.3R3-S4-EVO; * 21.4 versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R2-EVO.
Vulnerability class: Information Disclosure
EPSS: 0.002 (6.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Juniper Junos_os_evolved — versions 20.4, 21.1, 21.2
- Juniper Networks Junos Os Evolved — versions 0, 21.1R1, 21.2
Weakness classification (CWE)
References
- sirt@juniper.net (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-44187?
- CVE-2023-44187 is a medium-severity vulnerability in Juniper Junos OS Evolved, classified under Information Disclosure. CVSS score: 5.9/10. Published 2023-10-11.
- How severe is CVE-2023-44187?
- Medium severity. CVSS v3 base score is 5.9 out of 10.