CVE-2019-0057 - Vulnerability Details - OpenCVE

An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Juniper	Junos Nfx150 Nfx250

Configuration 1 [-]

AND

OR	cpe:2.3:o:juniper:junos::::::::
	cpe:2.3:o:juniper:junos:18.2:-::::::
	cpe:2.3:o:juniper:junos:18.2x75:::::::*

OR	cpe:2.3:h:juniper:nfx150:-:::::::*
	cpe:2.3:h:juniper:nfx250:-:::::::*

No data.

References

Link	Providers
https://kb.juniper.net/JSA10955

History

No history.

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2019-10-09T19:26:17.458102Z

Updated: 2024-09-17T00:25:27.294Z

Reserved: 2018-10-11T00:00:00

Link: CVE-2019-0057

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-10-09T20:15:16.690

Modified: 2024-11-21T04:16:09.287

Link: CVE-2019-0057

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["NFX Series"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "18.2R1, 18.2X75-D5", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-10-09T00:00:00", "descriptions": [{"lang": "en", "value": "An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "CWE 285 Improper Authorization", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-09T19:26:17", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://kb.juniper.net/JSA10955"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 18.2R1, 18.2X75-D5, and all subsequent releases."}], "source": {"advisory": "JSA10955", "defect": ["1341370"], "discovery": "INTERNAL"}, "title": "NFX Series: An attacker may be able to take control of the JDM application and subsequently the entire system.", "workarounds": [{"lang": "en", "value": "There are no viable workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.0.6"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2019-10-09T16:00:00.000Z", "ID": "CVE-2019-0057", "STATE": "PUBLIC", "TITLE": "NFX Series: An attacker may be able to take control of the JDM application and subsequently the entire system."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Junos OS", "version": {"version_data": [{"platform": "NFX Series", "version_affected": "<", "version_value": "18.2R1, 18.2X75-D5"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.6"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE 285 Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA10955", "refsource": "MISC", "url": "https://kb.juniper.net/JSA10955"}]}, "solution": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 18.2R1, 18.2X75-D5, and all subsequent releases."}], "source": {"advisory": "JSA10955", "defect": ["1341370"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "There are no viable workarounds for this issue."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:37:07.518Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.juniper.net/JSA10955"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2019-0057", "datePublished": "2019-10-09T19:26:17.458102Z", "dateReserved": "2018-10-11T00:00:00", "dateUpdated": "2024-09-17T00:25:27.294Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*", "matchCriteriaId": "06866A84-0B43-4647-A6F7-42D5448D2A2A", "versionEndIncluding": "18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*", "matchCriteriaId": "A8B5BD93-3C11-45D5-ACF0-7C4C01106C8A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.2x75:*:*:*:*:*:*:*", "matchCriteriaId": "097AEA48-4A45-489E-9C91-D5CE139994D2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx250:-:*:*:*:*:*:*:*", "matchCriteriaId": "7EB08A27-7777-4538-ADC4-9D2F89963C13", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5."}, {"lang": "es", "value": "Una debilidad de autorizaci\u00f3n inapropiada en Juniper Networks Junos OS, permite a un atacante autenticado local omitir los controles de seguridad regulares para acceder a la aplicaci\u00f3n Junos Device Manager (JDM) y tomar el control del sistema. Este problema afecta a: Juniper Networks Junos OS versiones anteriores a 18.2R1, 18.2X75-D5."}], "id": "CVE-2019-0057", "lastModified": "2024-11-21T04:16:09.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "sirt@juniper.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-09T20:15:16.690", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10955"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10955"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}