CVE-2019-0041

On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.

CVSS v3 8.6 HIGH
CVSS v2.0 5.0 MEDIUM

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://kb.juniper.net/JSA10933	Mitigation Vendor Advisory
https://kb.juniper.net/JSA10933	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:juniper:junos:18.2:-::::::
	cpe:2.3:o:juniper:junos:18.2:r1::::::

cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:16

Type	Values Removed	Values Added
References	~~() https://kb.juniper.net/JSA10933 - Mitigation, Vendor Advisory~~	() https://kb.juniper.net/JSA10933 - Mitigation, Vendor Advisory

Information

Published : 2019-04-10 20:29

Updated : 2024-11-21 04:16

NVD link : CVE-2019-0041

Mitre link : CVE-2019-0041

CVE.ORG link : CVE-2019-0041

JSON object : View

Products Affected

juniper

ex4300-mp
junos

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2019-0041", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2019-04-10T20:29:00.943", "references": [{"url": "https://kb.juniper.net/JSA10933", "tags": ["Mitigation", "Vendor Advisory"], "source": "sirt@juniper.net"}, {"url": "https://kb.juniper.net/JSA10933", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices."}, {"lang": "es", "value": "En los dispositivos de la serie EX4300-MP con cualquier filtro lo0 aplicado, el tr\u00e1fico de la red de tr\u00e1nsito puede alcanzar el plano de control por medio de la interfaz de bucle invertido (lo0). El dispositivo puede no reenviar dicho tr\u00e1fico. Este problema afecta a Juniper Networks Junos OS versi\u00f3n 18.2 y versiones anteriores a 18.2R1-S2, 18.2R2 en la serie EX4300-MP. Este problema no afecta a ning\u00fan otro dispositivo de la serie EX."}], "lastModified": "2024-11-21T04:16:06.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8B5BD93-3C11-45D5-ACF0-7C4C01106C8A"}, {"criteria": "cpe:2.3:o:juniper:junos:18.2:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "167EEC4F-729E-47C2-B0F8-E8108CE3E985"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F9EECCB3-37B3-4146-8F8C-4BBFF84499E9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "sirt@juniper.net"}