Main Vulnerability Database SB2022101276

SB2022101276 - Incorrect permission assignment for critical resource in Junos OS Evolved

Published: October 12, 2022

Security Bulletin ID SB2022101276

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2022-22248)

The vulnerability allows a local authenticated user to execute arbitrary code.

An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the contents of a configuration file which could cause another user to execute arbitrary commands within the context of the follow-on user's session.

If the follow-on user is a high-privileged administrator, the attacker could leverage this vulnerability to take complete control of the target system.

Remediation

Install update from vendor's website.

References

https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-Evolved-Incorrect-file-permissions-can-allow-low-privileged-user-to-cause-another-user-to-execute-arbitrary-commands-CVE-2022-22248