ID
VAR-202210-0720
CVE
CVE-2022-22248
TITLE
Juniper Networks Junos OS Evolved Vulnerability in improper permission assignment for critical resources in
Trust: 0.8
DESCRIPTION
An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the contents of a configuration file which could cause another user to execute arbitrary commands within the context of the follow-on user's session. If the follow-on user is a high-privileged administrator, the attacker could leverage this vulnerability to take complete control of the target system. While this issue is triggered by a user, other than the attacker, accessing the Junos shell, an attacker simply requires Junos CLI access to exploit this vulnerability. This issue affects Juniper Networks Junos OS Evolved: 20.4-EVO versions prior to 20.4R3-S1-EVO; All versions of 21.1-EVO; 21.2-EVO versions prior to 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 19.2R1-EVO. (DoS) It may be in a state
Trust: 1.71
AFFECTED PRODUCTS
| vendor: | juniper | model: | junos os evolved | scope: | eq | version: | 20.4 | Trust: 1.0 |
| vendor: | juniper | model: | junos os evolved | scope: | eq | version: | 21.2 | Trust: 1.0 |
| vendor: | juniper | model: | junos os evolved | scope: | eq | version: | 21.1 | Trust: 1.0 |
| vendor: | juniper | model: | junos os evolved | scope: | eq | version: | 21.3 | Trust: 1.0 |
| vendor: | ジュニパーネットワークス | model: | junos os evolved | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | ジュニパーネットワークス | model: | junos os evolved | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ジュニパーネットワークス | model: | junos os evolved | scope: | eq | version: | 21.2 | Trust: 0.8 |
| vendor: | ジュニパーネットワークス | model: | junos os evolved | scope: | eq | version: | 20.4 | Trust: 0.8 |
| vendor: | ジュニパーネットワークス | model: | junos os evolved | scope: | eq | version: | 21.1 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-732 | Trust: 1.1 |
| problemtype: | Improper permission assignment for critical resources (CWE-732) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
other
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-22248 | Trust: 3.3 |
| db: | JUNIPER | id: | JSA69905 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2022-019198 | Trust: 0.8 |
| db: | AUSCERT | id: | ESB-2022.5674 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202210-647 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-409777 | Trust: 0.1 |
REFERENCES
| url: | https://kb.juniper.net/jsa69905 | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-22248 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-22248/ | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2022.5674 | Trust: 0.6 |
| url: | https://vigilance.fr/vulnerability/junos-os-multiple-vulnerabilities-39531 | Trust: 0.6 |
SOURCES
| db: | VULHUB | id: | VHN-409777 |
| db: | JVNDB | id: | JVNDB-2022-019198 |
| db: | CNNVD | id: | CNNVD-202210-647 |
| db: | NVD | id: | CVE-2022-22248 |
LAST UPDATE DATE
2024-08-14T14:55:14.095000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-409777 | date: | 2022-10-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019198 | date: | 2023-10-24T08:19:00 |
| db: | CNNVD | id: | CNNVD-202210-647 | date: | 2022-11-09T00:00:00 |
| db: | NVD | id: | CVE-2022-22248 | date: | 2022-10-20T15:21:24.763 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-409777 | date: | 2022-10-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019198 | date: | 2023-10-24T00:00:00 |
| db: | CNNVD | id: | CNNVD-202210-647 | date: | 2022-10-12T00:00:00 |
| db: | NVD | id: | CVE-2022-22248 | date: | 2022-10-18T03:15:11.453 |