Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-31350

Опубликовано: 19 окт. 2021
Источник: nvd
CVSS3: 7.5
CVSS3: 8.8
CVSS2: 9
EPSS Низкий

Описание

An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passing configuration operations directly to the management daemon (mgd) process, which runs as root. This issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Juniper Networ

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r1-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r2-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:18.4:r3-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r1-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.1:r3-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r1-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.2:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.3:r3-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:19.4:r3-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r1-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.1:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.2:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.3:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.3:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.3:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.3:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:18.3:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.1:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.1:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.3:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.3:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:19.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.1:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.1:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.1:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.3:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.3:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.3:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:21.1:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:21.1:r1-s1:*:*:*:*:*:*

EPSS

Процентиль: 56%
0.00342
Низкий

7.5 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-269
CWE-269

Связанные уязвимости

github логотип

GHSA-8jxq-fcr2-68jw

github
больше 3 лет назад

An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passing configuration operations directly to the management daemon (mgd) process, which runs as root. This issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Juniper Net...

fstec логотип

BDU:2021-06144

CVSS3: 8.8
fstec
больше 4 лет назад

Уязвимость компонента Juniper Extension Toolkit (JET) операционных систем Juniper Networks Junos OS и Juniper Networks Junos OS Evolved, позволяющая нарушителю повысить свои привилегии в системе

EPSS

Процентиль: 56%
0.00342
Низкий

7.5 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-269
CWE-269