CVE-2024-21615

{"id": "CVE-2024-21615", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.3}]}, "published": "2024-04-12T15:15:24.153", "references": [{"url": "https://supportportal.juniper.net/JSA75756", "source": "sirt@juniper.net"}, {"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "source": "sirt@juniper.net"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.\n\nOn all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system.\nThis issue affects:\n\nJunos OS:\n\n\n\n * all versions before 21.2R3-S7,\u00a0\n\n * from 21.4 before 21.4R3-S5,\u00a0\n\n * from 22.1 before 22.1R3-S5,\u00a0\n\n * from 22.2 before 22.2R3-S3,\u00a0\n\n * from 22.3 before 22.3R3-S2,\u00a0\n\n * from 22.4 before 22.4R3,\u00a0\n\n * from 23.2 before 23.2R1-S2.\n\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n * all versions before 21.2R3-S7-EVO,\u00a0\n\n * from 21.3 before 21.3R3-S5-EVO,\u00a0\n\n * from 21.4 before 21.4R3-S5-EVO,\u00a0\n\n * from 22.1 before 22.1R3-S5-EVO,\u00a0\n\n * from 22.2 before 22.2R3-S3-EVO,\u00a0\n\n * from 22.3 before 22.3R3-S2-EVO,\n\n * from 22.4 before 22.4R3-EVO,\u00a0\n\n * from 23.2 before 23.2R1-S2.\n\n\n\n\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de permisos predeterminados incorrectos en Juniper Networks Junos OS y Junos OS Evolved permite que un atacante local con pocos privilegios acceda a informaci\u00f3n confidencial en el sistema. En todas las plataformas Junos OS y Junos OS Evolved, cuando se configuran las opciones de seguimiento de NETCONF y un superusuario realiza acciones espec\u00edficas a trav\u00e9s de NETCONF, un usuario con pocos privilegios puede acceder a informaci\u00f3n confidencial que compromete la confidencialidad del sistema. Este problema afecta a: Junos OS: * todas las versiones anteriores a 21.2R3-S7, * desde 21.4 anterior a 21.4R3-S5, * desde 22.1 anterior a 22.1R3-S5, * desde 22.2 anterior a 22.2R3-S3, * desde 22.3 anterior a 22.3R3- S2, * de 22.4 antes de 22.4R3, * de 23.2 antes de 23.2R1-S2. Junos OS Evolved: * todas las versiones anteriores a 21.2R3-S7-EVO, * desde 21.3 anterior a 21.3R3-S5-EVO, * desde 21.4 anterior a 21.4R3-S5-EVO, * desde 22.1 anterior a 22.1R3-S5-EVO, * desde 22.2 antes de 22.2R3-S3-EVO, * desde 22.3 antes de 22.3R3-S2-EVO, * desde 22.4 antes de 22.4R3-EVO, * desde 23.2 antes de 23.2R1-S2."}], "lastModified": "2024-04-15T13:15:51.577", "sourceIdentifier": "sirt@juniper.net"}