CVE-2021-0256

Katalog CVE

CVSS 5.5 · Medium EPSS 0,21%

Kerentanan Execution with Unnecessary Privileges pada juniper junos. Skor CVSS 3.1 5.5 (Medium) menurut juniper.net.

Deskripsi (NVD)

A sensitive information disclosure vulnerability in the mosquitto message broker of Juniper Networks Junos OS may allow a locally authenticated user with shell access the ability to read portions of sensitive files, such as the master.passwd file. Since mosquitto is shipped with setuid permissions enabled and is owned by the root user, this vulnerability may allow a local privileged user the ability to run mosquitto with root privileges and access sensitive information stored on the local filesystem. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S12, 17.4 versions prior to 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.3 versions prior to 18.3R3-S4; 19.1 versions prior to 19.1R3-S4; 19.3 versions prior to 19.3R3-S1, 19.3R3-S2; 19.4 versions prior to 19.4R2-S3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S3, 20.2R2, 20.2R3.

Rincian

Terbit di NVD

22 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber juniper.net
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges
CWE-269: Improper Privilege Management

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 182 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://kb.juniper.net/JSA11175 advisory vendor