CVE-2024-39532

MEDIUM

Juniper Junos < 21.2 - Log Information Exposure

Title source: rule
STIX 2.1

Description

An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information. When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information. This issue affects: Junos OS: * All versions before 21.2R3-S9; * 21.4 versions before 21.4R3-S9; * 22.2 versions before 22.2R2-S1, 22.2R3; * 22.3 versions before 22.3R1-S1, 22.3R2; Junos OS Evolved: * All versions before before 22.1R3-EVO; * 22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.

Scores

CVSS v3 6.3
EPSS 0.0007
EPSS Percentile 20.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-532
Status published
Products (7)
juniper/junos 21.2 (16 CPE variants)
juniper/junos 21.4 (16 CPE variants)
juniper/junos 22.2 (6 CPE variants)
juniper/junos 22.3 (3 CPE variants)
juniper/junos < 21.2
juniper/junos_os_evolved 22.1 (6 CPE variants)
juniper/junos_os_evolved 22.2 (2 CPE variants)
Published Jul 11, 2024
Tracked Since Feb 18, 2026