Junos OS: SNMP fails to properly perform authorization checks on incoming received SNMP requests. (Juniper Networks Junos OS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.89 % · centile 59 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- juniper
- Statut NVD
- Modified
Rechercher sur…
Description
An improper authorization vulnerability in the Simple Network Management Protocol daemon (snmpd) service of Juniper Networks Junos OS leads an unauthenticated attacker being able to perform SNMP read actions, an Exposure of System Data to an Unauthorized Control Sphere, or write actions to OIDs that support write operations, against the device without authentication. This issue affects: Juniper Networks Junos OS: 17.2 version 17.2R1 and later versions; 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S12, 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R1-S8, 18.4R2-S5, 18.4R3; 19.1 versions prior to 19.1R2; 19.2 versions prior to 19.2R1-S6, 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R1.
Faiblesses (CWE)
- CWE-285 — Autorisation incorrecte
- CWE-497 — Exposition d'informations système sensibles à une sphère non autorisée
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | juniper |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · sirt@juniper.net (Secondary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-2879
- GCVE · GCVE-0-2021-0260
Avis du CERT-FR
- CERTFR-2021-AVI-290 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:juniper:junos:17.2:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r1-s8:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r2-s11:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r2-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r2-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r2-s7:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.2:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r1-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r2-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3:-:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s10:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s7:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.3:r3-s8:*:*:*:*:*:*cpe:2.3:o:juniper:junos:17.4:-:*:*:*:*:*:*- +117 autres
Produits affectés
| Produit | Versions |
|---|---|
| Juniper Networks · Junos OS | unaffected unspecified < 17.2R1 ; affected 17.2R1 < 17.2* ; affected 17.3 < 17.3R3-S9 ; affected 17.4 < 17.4R2-S12, 17.4R3-S5 ; affected 18.1 < 18.1R3-S13 ; affected 18.2 < 18.2R3-S8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |