rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-39552 Junos OS and Junos OS Evolved: Malformed BGP UPDATE causes RPD crash
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, RPD crashes and restarts.

Continuous receipt of the malformed BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations.  This issue requires a remote attacker to have at least one established BGP session.

This issue affects:
 
Juniper Networks Junos OS:
  *  All versions earlier than 20.4R3-S9;
  *  21.2 versions earlier than 21.2R3-S7;
  *  21.3 versions earlier than 21.3R3-S5;
  *  21.4 versions earlier than 21.4R3-S6;
  *  22.1 versions earlier than 22.1R3-S4;
  *  22.2 versions earlier than 22.2R3-S3;
  *  22.3 versions earlier than 22.3R3-S2;
  *  22.4 versions earlier than 22.4R3;
  *  23.2 versions earlier than 23.2R2.



Juniper Networks Junos OS Evolved:
  *  All versions earlier than 21.2R3-S7;
  *  21.3-EVO versions earlier than 21.3R3-S5;
  *  21.4-EVO versions earlier than 21.4R3-S8;
  *  22.1-EVO versions earlier than 22.1R3-S4;
  *  22.2-EVO versions earlier than 22.2R3-S3;
  *  22.3-EVO versions earlier than 22.3R3-S2;
  *  22.4-EVO versions earlier than 22.4R3;
  *  23.2-EVO versions earlier than 23.2R2.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Juniper SIRT would like to acknowledge and thank Matteo Memilli (mmemelli@amazon.com) from Amazon for responsibly reporting this vulnerability.
Published: 2024-07-11T16:30:36.672Z
CVE-2024-39553 Junos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS).
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity.

This issue only happens when inline jflow is configured.

This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. 

This issue affects Juniper Networks Junos OS Evolved: 
  *  21.4 versions earlier than 21.4R3-S7-EVO; 
  *  22.2 versions earlier than 22.2R3-S3-EVO;
  *  22.3 versions earlier than 22.3R3-S2-EVO;
  *  22.4 versions earlier than 22.4R3-EVO;
  *  23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2024-07-11T16:32:03.929Z
CVE-2024-39554 Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the 

Routing Protocol Daemon (rpd)

 of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.  However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.

On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.  Under certain circumstance and with specific timing, this could result in an rpd crash.

This issue only affects systems with BGP multipath enabled.


This issue affects:

Junos OS: 


  *  All versions of 21.1
  *  from 21.2 before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3-S2, 
  *  from 22.4 before 22.4R3, 
  *  from 23.2 before 23.2R2.




Junos OS Evolved: 


  *  All versions of 21.1-EVO,
  *  All versions of 21.2-EVO,
  *  from 21.4-EVO before 21.4R3-S6-EVO, 
  *  from 22.1-EVO before 22.1R3-S5-EVO, 
  *  from 22.2-EVO before 22.2R3-S3-EVO, 
  *  from 22.3-EVO before 22.3R3-S2-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.



Versions of Junos OS before 21.1R1 are unaffected by this vulnerability.
Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.
Problem types: cwe_id: CWE-362
description: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:32:34.310Z
CVE-2024-39555 Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset
An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update message to cause the session to reset, resulting in a Denial of Service (DoS).  Continued receipt and processing of these malformed BGP update messages will create a sustained Denial of Service (DoS) condition.

Upon receipt of a BGP update message over an established BGP session containing a specifically malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the malformed attributes within the update results in improper parsing of remaining attributes, leading to session reset:

BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list)

Only systems with segment routing enabled are vulnerable to this issue.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP session.

This issue affects:

Junos OS: 


  *  All versions before 21.4R3-S8, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S3, 
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R1-S2, 23.4R2.


Junos OS Evolved: 

  *  All versions before 21.4R3-S8-EVO, 
  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-S3-EVO, 
  *  from 23.2-EVO before 23.2R2-S1-EVO, 
  *  from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:36:48.706Z
CVE-2024-39556 Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow
A Stack-Based Buffer Overflow vulnerability in Juniper Networks Junos OS and Juniper Networks Junos OS Evolved may allow a local, low-privileged attacker with access to the CLI the ability to load a malicious certificate file, leading to a limited Denial of Service (DoS) or privileged code execution.

By exploiting the 'set security certificates' command with a crafted certificate file, a malicious attacker with access to the CLI could cause a crash of the command management daemon (mgd), limited to the local user's command interpreter, or potentially trigger a stack-based buffer overflow.


This issue affects:

 Junos OS: 


  *  All versions before 21.4R3-S7, 
  *  from 22.1 before 22.1R3-S6, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S2, 
  *  from 23.2 before 23.2R2, 
  *  from 23.4 before 23.4R1-S1, 23.4R2; 




Junos OS Evolved: 


  *  All versions before 21.4R3-S7-EVO, 
  *  from 22.1-EVO before 22.1R3-S6-EVO, 
  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-S2-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO, 
  *  from 23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-07-10T22:38:44.894Z
CVE-2024-39557 Junos OS Evolved: MAC table changes cause a memory leak
An Uncontrolled Resource Consumption vulnerability in the 

Layer 2 Address Learning Daemon (l2ald)

 of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a memory leak, eventually exhausting all system memory, leading to a system crash and Denial of Service (DoS).

Certain MAC table updates cause a small amount of memory to leak.  Once memory utilization reaches its limit, the issue will result in a system crash and restart.

To identify the issue, execute the CLI command:
 
user@device> show platform application-info allocations app l2ald-agent
EVL Object Allocation Statistics:
 
 Node    Application       Context   Name                                 Live     Allocs     Fails       Guids
 re0     l2ald-agent                 net::juniper::rtnh::L2Rtinfo         1069096  1069302    0           1069302
 re0     l2ald-agent                 net::juniper::rtnh::NHOpaqueTlv       114      195        0           195



This issue affects Junos OS Evolved: 


  *  All versions before 21.4R3-S8-EVO,

  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:39:48.575Z
CVE-2024-39558 Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR
An Unchecked Return Value vulnerability in the Routing Protocol Daemon (rpd) on Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows a logically adjacent, unauthenticated attacker sending a specific PIM packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS), when PIM is configured with Multicast-only Fast Reroute (MoFRR). Continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.

This issue is observed on Junos and Junos Evolved platforms where PIM is configured along with MoFRR. MoFRR tries to select the active path, but due to an internal timing issue, rpd is unable to select the forwarding next-hop towards the source, resulting in an rpd crash.

This issue affects:

Junos OS: 


  *  All versions before 20.4R3-S10, 
  *  from 21.2 before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3, 
  *  from 22.4 before 22.4R2; 




Junos OS Evolved: 


  *  All versions before 20.4R3-S10 -EVO,
  *  All versions of 21.2-EVO,
  *  from 21.4-EVO before 21.4R3-S9-EVO,
  *  from 22.1-EVO before 22.1R3-S5-EVO,
  *  from 22.2-EVO before 22.2R3-S3-EVO,
  *  from 22.3-EVO before 22.3R3-EVO,
  *  from 22.4-EVO before 22.4R2-EVO.
Problem types: cwe_id: CWE-252
description: CWE-252 Unchecked Return Value
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:40:44.365Z
CVE-2024-39559 Junos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabled
An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device (vmcore) by sending a specific TCP packet over an established TCP session with MD5 authentication enabled, destined to an accessible port on the device, resulting in a Denial of Service (DoS).  The receipt of this packet must occur within a specific timing window outside the attacker's control (i.e., race condition).

Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects dual RE systems with Nonstop Active Routing (NSR) enabled.
Exploitation can only occur over TCP sessions with MD5 authentication enabled (e.g., BGP with MD5 authentication).

This issue affects Junos OS Evolved: 



  *  All versions before 21.2R3-S8-EVO, 
  *  from 21.4-EVO before 21.4R3-S6-EVO, 
  *  from 22.1-EVO before 22.1R3-S4-EVO, 
  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R2-S2-EVO, 22.4R3-EVO.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:42:02.555Z
CVE-2024-39560 Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a logically adjacent downstream RSVP neighbor to cause kernel memory exhaustion, leading to a kernel crash, resulting in a Denial of Service (DoS).

The kernel memory leak and eventual crash will be seen when the downstream RSVP neighbor has a persistent error which will not be corrected.

System kernel memory can be monitored through the use of the 'show system kernel memory' command as shown below:

user@router> show system kernel memory    
Real memory total/reserved: 4130268/ 133344 Kbytes
kmem map free: 18014398509110220 Kbytes

This issue affects:
Junos OS:


  *  All versions before 20.4R3-S9,
  *  All versions of 21.2,
  *  from 21.4 before 21.4R3-S5,
  *  from 22.1 before 22.1R3-S5,
  *  from 22.2 before 22.2R3-S3,
  *  from 22.3 before 22.3R3-S2,
  *  from 22.4 before 22.4R3,
  *  from 23.2 before 23.2R2;


Junos OS Evolved:


  *  All versions before 21.4R3-S5-EVO,
  *  from 22.1-EVO before 22.1R3-S5-EVO, 
  *  from 22.2-EVO before 22.2R3-S3-EVO, 
  *  from 22.3-EVO before 22.3R3-S2-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:44:55.736Z
CVE-2024-39561 Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path
An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on 

SRX4600 and SRX5000 Series

 allows an attacker to send TCP packets with 

SYN/FIN or SYN/RST

 flags, bypassing the expected blocking of these packets.

A TCP packet with SYN/FIN or SYN/RST should be dropped in flowd. However, when no-syn-check and Express Path are enabled, these TCP packets are unexpectedly transferred to the downstream network.

This issue affects Junos OS on SRX4600 and SRX5000 Series: 


  *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S7, 
  *  from 22.1 before 22.1R3-S6, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S2, 
  *  from 23.2 before 23.2R2, 
  *  from 23.4 before 23.4R1-S1, 23.4R2.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2024-07-10T22:46:34.024Z
CVE-2024-39562 Junos OS Evolved: A high rate of SSH connections causes a Denial of Service
A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS) by blocking SSH access for legitimate users.  Continued receipt of these connections will create a sustained Denial of Service (DoS) condition.

The issue is triggered when a high rate of concurrent SSH requests are received and terminated in a specific way, causing xinetd to crash, and leaving defunct sshd processes. Successful exploitation of this vulnerability blocks both SSH access as well as services which rely upon SSH, such as SFTP, and Netconf over SSH.

Once the system is in this state, legitimate users will be unable to SSH to the device until service is manually restored.  See WORKAROUND section below.

Administrators can monitor an increase in defunct sshd processes by utilizing the CLI command:

  > show system processes | match sshd
  root     25219 30901  0 Jul16 ?        00:00:00 [sshd] <defunct>

This issue affects Juniper Networks Junos OS Evolved:
  *  All versions prior to 21.4R3-S7-EVO
  *  22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S2-EVO;
  *  22.4-EVO versions prior to 22.4R3-EVO;
  *  23.2-EVO versions prior to 23.2R2-EVO.



This issue does not affect Juniper Networks Junos OS Evolved 22.1-EVO nor 22.2-EVO.
Problem types: cwe_id: CWE-772
description: CWE-772 Missing Release of Resource after Effective Lifetime
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-07-10T22:47:22.616Z
CVE-2024-39563 Junos Space: Remote Command Execution (RCE) vulnerability in web application
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device.

A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance.

This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Juniper Networks
product: Junos Space
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-10-11T15:21:18.354Z