Riskcovery

CVE-2023-44187

Junos OS Evolved: 'file copy' CLI command can disclose password to shell users

State
Published
Severity
5.9 Medium
Published
Oct 11, 2023
Updated
Sep 18, 2024
Reserved
Sep 26, 2023

Read the record on cve.org

Description

An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to view passwords supplied on the CLI command-line. These credentials can then be used to provide unauthorized access to the remote system.

This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S7-EVO; * 21.1 versions 21.1R1-EVO and later; * 21.2 versions prior to 21.2R3-S5-EVO; * 21.3 versions prior to 21.3R3-S4-EVO; * 21.4 versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R2-EVO.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:Njuniper

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Junos OS EvolvedJuniper Networks
  • before 20.4R3-S7-EVOAffected
  • 21.1R1 to before 21.1*Affected
  • 21.2 to before 21.2R3-S5-EVOAffected
  • 21.3 to before 21.3R3-S4-EVOAffected
  • 21.4 to before 21.4R3-S4-EVOAffected
  • 22.1 to before 22.1R3-S2-EVOAffected
  • 22.2 to before 22.2R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.