CVE-2024-30390

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30390
An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service (DoS) to the management plane. When an incoming connection was blocked because it exceeded the connections-per-second rate-limit, the system doesn't consider existing connections anymore for subsequent connection attempts so that the connection limit can be exceeded. This issue affects Junos OS Evolved: All versions before 21.4R3-S4-EVO, 22.1-EVO versions before 22.1R3-S3-EVO, 22.2-EVO versions before 22.2R3-S2-EVO,  22.3-EVO versions before 22.3R2-S1-EVO, 22.3R3-EVO.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://supportportal.juniper.net/JSA79183
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Configurations

No configuration.

History

15 Apr 2024, 13:15

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de restricción inadecuada de intentos de autenticación excesivos en Juniper Networks Junos OS Evolved permite que un atacante basado en red no autenticado cause una denegación de servicio (DoS) limitada en el plano de administración. Cuando se bloquea una conexión entrante porque excedió el límite de velocidad de conexiones por segundo, el sistema ya no considera las conexiones existentes para intentos de conexión posteriores, de modo que se pueda exceder el límite de conexión. Este problema afecta a Junos OS Evolved: todas las versiones anteriores a 21.4R3-S4-EVO, versiones 22.1-EVO anteriores a 22.1R3-S3-EVO, versiones 22.2-EVO anteriores a 22.2R3-S2-EVO, versiones 22.3-EVO anteriores a 22.3R2-S1 -EVO, 22.3R3-EVO.

12 Apr 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-12 16:15

Updated : 2024-04-15 13:15

NVD link : CVE-2024-30390

Mitre link : CVE-2024-30390

CVE.ORG link : CVE-2024-30390

JSON object : View

Products Affected

No product.

CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts