{"containers": {"cna": {"affected": [{"platforms": ["NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"status": "unaffected", "version": "15.1"}, {"status": "unaffected", "version": "16.2 16.2"}, {"lessThan": "15.1F6-S12", "status": "affected", "version": "15.1F", "versionType": "custom"}, {"changes": [{"at": "16.1R6-S6, 16.1R7-S3", "status": "unaffected"}], "lessThan": "16.1*", "status": "affected", "version": "16.1R6", "versionType": "custom"}, {"lessThan": "17.1R3", "status": "affected", "version": "17.1", "versionType": "custom"}, {"changes": [{"at": "17.2R3-S1", "status": "unaffected"}], "lessThan": "17.2*", "status": "affected", "version": "17.2R1-S3, 17.2R3", "versionType": "custom"}, {"changes": [{"at": "17.3R3-S3", "status": "unaffected"}], "lessThan": "17.3*", "status": "affected", "version": "17.3R1-S1, 17.3R2", "versionType": "custom"}, {"changes": [{"at": "17.4R1-S6, 17.4R2-S2, 17.4R3", "status": "unaffected"}], "lessThan": "17.4*", "status": "affected", "version": "17.4R1", "versionType": "custom"}, {"lessThan": "18.1R2-S4, 18.1R3-S3", "status": "affected", "version": "18.1", "versionType": "custom"}, {"lessThan": "18.2R2", "status": "affected", "version": "18.2", "versionType": "custom"}, {"lessThan": "18.2X75-D40", "status": "affected", "version": "18.2X75", "versionType": "custom"}, {"lessThan": "18.3R1-S2, 18.3R2", "status": "affected", "version": "18.3", "versionType": "custom"}, {"lessThan": "18.4R1-S1, 18.4R2", "status": "affected", "version": "18.4", "versionType": "custom"}]}], "configurations": [{"lang": "en", "value": "To identify whether the device has NG-RE with vmhost, customer can run the following command:\n > show vmhost status\n Compute cluster: rainier-re-cc\n Compute Node: rainier-re-cn, Online\nIf the \"show vmhost status\" is not supported, then the device does not have NG-RE with vmhost."}], "datePublic": "2019-10-09T00:00:00", "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "privilege escalation", "lang": "en", "type": "text"}]}, {"descriptions": [{"description": "Improper Privilege Management.", "lang": "en", "type": "text"}]}, {"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-10-09T19:26:18", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://kb.juniper.net/JSA10975"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve these specific issues: 15.1F6-S12, 16.1R6-S6, 16.1R7-S3, 17.1R3, 17.2R3-S1, 17.3R3-S3, 17.4R1-S6, 17.4R2-S2, 17.4R3, 18.1R2-S4, 18.1R3-S3, 18.2R2, 18.2R3, 18.2X75-D40, 18.3R1-S2, 18.3R2, 18.4R1-S1, 18.4R2, 19.1R1, and all subsequent releases."}], "source": {"advisory": "JSA10975", "defect": ["1398333"], "discovery": "INTERNAL"}, "title": "Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.", "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.0.6"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2019-10-09T16:00:00.000Z", "ID": "CVE-2019-0074", "STATE": "PUBLIC", "TITLE": "Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Junos OS", "version": {"version_data": [{"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "15.1F", "version_value": "15.1F6-S12"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "!", "version_name": "15.1", "version_value": "15.1"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": ">=", "version_name": "16.1", "version_value": "16.1R6"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "16.1", "version_value": "16.1R6-S6, 16.1R7-S3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "!", "version_name": "16.2", "version_value": "16.2"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "17.1", "version_value": "17.1R3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": ">=", "version_name": "17.2", "version_value": "17.2R1-S3, 17.2R3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "17.2", "version_value": "17.2R3-S1"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": ">=", "version_name": "17.3", "version_value": "17.3R1-S1, 17.3R2"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "17.3", "version_value": "17.3R3-S3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": ">=", "version_name": "17.4", "version_value": "17.4R1"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "17.4", "version_value": "17.4R1-S6, 17.4R2-S2, 17.4R3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "18.1", "version_value": "18.1R2-S4, 18.1R3-S3"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "18.2", "version_value": "18.2R2"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "18.2X75", "version_value": "18.2X75-D40"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "18.3", "version_value": "18.3R1-S2, 18.3R2"}, {"platform": "NFX150, QFX10K, EX9200, MX, and PTX Series with NG-RE", "version_affected": "<", "version_name": "18.4", "version_value": "18.4R1-S1, 18.4R2"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "configuration": [{"lang": "en", "value": "To identify whether the device has NG-RE with vmhost, customer can run the following command:\n > show vmhost status\n Compute cluster: rainier-re-cc\n Compute Node: rainier-re-cn, Online\nIf the \"show vmhost status\" is not supported, then the device does not have NG-RE with vmhost."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.6"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "privilege escalation"}]}, {"description": [{"lang": "eng", "value": "Improper Privilege Management."}]}, {"description": [{"lang": "eng", "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"description": [{"lang": "eng", "value": "CWE-23 Relative Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA10975", "refsource": "MISC", "url": "https://kb.juniper.net/JSA10975"}]}, "solution": [{"lang": "en", "value": "The following software releases have been updated to resolve these specific issues: 15.1F6-S12, 16.1R6-S6, 16.1R7-S3, 17.1R3, 17.2R3-S1, 17.3R3-S3, 17.4R1-S6, 17.4R2-S2, 17.4R3, 18.1R2-S4, 18.1R3-S3, 18.2R2, 18.2R3, 18.2X75-D40, 18.3R1-S2, 18.3R2, 18.4R1-S1, 18.4R2, 19.1R1, and all subsequent releases."}], "source": {"advisory": "JSA10975", "defect": ["1398333"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "There are no known workarounds for this issue."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:37:07.350Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.juniper.net/JSA10975"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2019-0074", "datePublished": "2019-10-09T19:26:18.153175Z", "dateReserved": "2018-10-11T00:00:00", "dateUpdated": "2024-09-17T03:38:51.289Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:15.1:f1:*:*:*:*:*:*", "matchCriteriaId": "C56F5C48-BA48-4EE1-88BE-782B3CFB3B90", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f2:*:*:*:*:*:*", "matchCriteriaId": "1C56E6C3-BBB6-4853-91D9-99C7676D0CD4", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s1:*:*:*:*:*:*", "matchCriteriaId": "AC196685-3B0C-4754-AE6A-6BE456CC6B52", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s2:*:*:*:*:*:*", "matchCriteriaId": "F0146AA9-C513-4871-A62A-52C9F40EB958", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s3:*:*:*:*:*:*", "matchCriteriaId": "A18672EF-E33D-4ACE-BB0A-561812F502C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s4:*:*:*:*:*:*", "matchCriteriaId": "CEF0E75F-831E-40B8-926D-B2E92A84E31B", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f3:*:*:*:*:*:*", "matchCriteriaId": "0E0ECBD8-3D66-49DA-A557-5695159F0C06", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f4:*:*:*:*:*:*", "matchCriteriaId": "0EAA2998-A0D6-4818-9E7C-25E8099403E7", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f5:*:*:*:*:*:*", "matchCriteriaId": "2D4ADFC5-D4B8-4A68-95D8-8ADF92C1CFE8", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f6:*:*:*:*:*:*", "matchCriteriaId": "71D211B9-B2FE-4324-AAEE-8825D5238E48", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:15.1:f6-s3:*:*:*:*:*:*", "matchCriteriaId": "CA0D028E-0B07-4CB2-863A-527806B9917C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:16.1:r6:*:*:*:*:*:*", "matchCriteriaId": "92F35C19-5AD2-4F98-8313-2E880714DF3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:16.1:r6-s1:*:*:*:*:*:*", "matchCriteriaId": "DF5A9D31-ED7D-4390-B46D-7E46089DB932", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:16.1:r7:*:*:*:*:*:*", "matchCriteriaId": "6B4A4960-0241-4BF4-8857-8B7BE33466B6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:17.1:-:*:*:*:*:*:*", "matchCriteriaId": "CC9B5CDE-3A50-4CD3-962A-FA0989939F37", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r1:*:*:*:*:*:*", "matchCriteriaId": "7572C187-4D58-4E0D-A605-B2B13EFF5C6B", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "4E0D42C4-9B4D-44F9-BC84-E7994404598B", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s10:*:*:*:*:*:*", "matchCriteriaId": "CC7A70CD-3A5E-4F01-8469-E5CD406BB04F", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s2:*:*:*:*:*:*", "matchCriteriaId": "DE2C20D8-3C73-4B87-BA41-DBFBCA5FBA58", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s3:*:*:*:*:*:*", "matchCriteriaId": "54D887B4-D2F4-4537-8298-B98D01396F12", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s4:*:*:*:*:*:*", "matchCriteriaId": "1C1B5AE6-A323-4744-BCA1-25E46D2D27BB", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s5:*:*:*:*:*:*", "matchCriteriaId": "0AB39E2F-0D67-4FA6-84B8-36684E971002", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s6:*:*:*:*:*:*", "matchCriteriaId": "A32C3702-48DE-47CF-B0D1-3A629676AD03", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.1:r2-s7:*:*:*:*:*:*", "matchCriteriaId": "B9695B3E-FCDA-4DF0-B714-8B4F87AA647D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:17.2:-:*:*:*:*:*:*", "matchCriteriaId": "BCEE8D9C-6D64-4A9B-A74A-57A0BF4086C6", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "595987A6-D8CE-41ED-B51C-EF9CD3B47AD0", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s4:*:*:*:*:*:*", "matchCriteriaId": "CFA3526C-FF53-4823-B6AC-0BA91BFB532D", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*", "matchCriteriaId": "9689695F-53EB-4B35-9072-750E7282B011", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s8:*:*:*:*:*:*", "matchCriteriaId": "4F7CE683-5647-455B-936C-DF0D973A180A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r2-s6:*:*:*:*:*:*", "matchCriteriaId": "B87ECEAD-FD18-4252-8D46-F281DD4125AC", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.2:r2-s7:*:*:*:*:*:*", "matchCriteriaId": "C6788EE2-B0DA-470E-B72E-E8D5CCFB5259", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "C52E355B-DA7D-4FDE-B2D7-A3C3C9C99918", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*", "matchCriteriaId": "69FC46D4-39E2-4E2F-A1D3-1001769A7115", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "32F83E8B-A816-4F26-95F8-F0DA7F3DF426", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*", "matchCriteriaId": "2C433359-BC8B-4E69-BE74-A31EB148083A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.3:r3:*:*:*:*:*:*", "matchCriteriaId": "25C7C3D0-A203-4979-8375-A610ADD48E9E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*", "matchCriteriaId": "988D317A-0646-491F-9B97-853E8E208276", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "605F1AD7-5B09-44F0-9017-15AB3EEE559C", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "CEDDCD30-2255-4FA9-B3E2-9E88AB6F8D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s4:*:*:*:*:*:*", "matchCriteriaId": "4E4EB6B0-8DB2-4199-96E4-30195D49F756", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s7:*:*:*:*:*:*", "matchCriteriaId": "F0F65DCA-34B9-4CE8-91C9-426AAAEB4097", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r2:*:*:*:*:*:*", "matchCriteriaId": "0E0CE79A-157D-47DE-BE65-936BC12470EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "05060C06-18C1-40E8-AE01-385B036CC9AA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:*", "matchCriteriaId": "0DFDD907-5305-4602-8A9C-685AA112C342", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*", "matchCriteriaId": "2EF6F4C1-6A7E-474F-89BC-7A3C50FD8CAC", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "84F5BCBA-404B-4BC9-B363-CE6D231B0D6D", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:*", "matchCriteriaId": "18A4CA3E-DA61-49CC-8476-3A476CCB2B83", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:*", "matchCriteriaId": "658841A9-BEC9-433E-81D0-47DE82887C4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:*", "matchCriteriaId": "C97683B3-A07B-428F-9535-C49B55305679", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*", "matchCriteriaId": "A8B5BD93-3C11-45D5-ACF0-7C4C01106C8A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.2:r1-s5:*:*:*:*:*:*", "matchCriteriaId": "238EC996-8E8C-4332-916F-09E54E6EBB9D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.2x75:-:*:*:*:*:*:*", "matchCriteriaId": "EEC6BBCF-6429-4BD8-9728-4A1B0616D7C9", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.2x75:d20:*:*:*:*:*:*", "matchCriteriaId": "12805C4D-2737-41E4-8950-5B48636765F9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.3:-:*:*:*:*:*:*", "matchCriteriaId": "1BB9C2BB-D20B-41E9-B75F-7FAD9ECCDB99", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.3:r1:*:*:*:*:*:*", "matchCriteriaId": "5342C3DC-D640-47AB-BD76-3444852988A2", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "8AB8585E-EDC6-4400-BEE3-3A6A7C922C90", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s3:*:*:*:*:*:*", "matchCriteriaId": "6F6EAFC3-C3AC-4361-8530-39FCF89702F7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:*", "matchCriteriaId": "74CA9010-D3DE-487B-B46F-589A48AB0F0A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:*", "matchCriteriaId": "A38F224C-8E9B-44F3-9D4F-6C9F04F57927", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "8F73B88B-E66C-4ACD-B38D-9365FB230ABA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D08A8D94-134A-41E7-8396-70D8B0735E9C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:nfx150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9AE81FA-B0F3-4F0B-A2D1-2BB590345058", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en los dispositivos de las series NFX150 y QFX10K, EX9200, MX y PTX con el Next-Generation Routing Engine (NG-RE), permite a un usuario autenticado local leer archivos confidenciales del sistema. Este problema solo afecta a las series NFX150 y QFX10K, EX9200, MX y PTX con el Next-Generation Routing Engine (NG-RE) que utiliza vmhost. Este problema afecta al Juniper Networks Junos OS en las series NFX150 y QFX10K, EX9200, MX y PTX con NG-RE y vmhost: versiones 15.1F anteriores a 15.1F6-S12 16.1 a partir de las versiones 16.1R6 y posteriores, incluyendo Versiones de Servicio, anterior a 16.1R6-S6, 16.1R7-S3; versiones 17.1 anteriores a 17.1R3; versiones 17.2 a partir de 17.2R1-S3, 17.2R3 y posteriores, incluidas las versiones de servicio, anteriores a 17.2R3-S1; 17.3 versiones a partir de 17.3R1-S1, 17.3R2 y versiones posteriores, incluyendo Versiones de Servicio, anteriores a 17.3R3-S3; versiones 17.4 a partir de 17.4R1 y posteriores, incluyendo Versiones de Servicio, anteriores a 17.4R1-S6, 17.4R2-S2, 17.4R3; versiones 18.1 anteriores a 18.1R2-S4, 18.1R3-S3; versiones 18.2 anteriores a 18.2R2; versiones 18.2X75 anteriores a 18.2X75-D40; versiones 18.3 anteriores a 18.3R1-S2, 18.3R2; versiones 18.4 anteriores a 18.4R1-S1, 18.4R2. Este problema no afecta: Juniper Networks Junos OS versiones 15.1 y 16.2."}], "id": "CVE-2019-0074", "lastModified": "2021-02-05T16:48:54.243", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Secondary"}]}, "published": "2019-10-09T20:15:18.393", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10975"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}], "source": "sirt@juniper.net", "type": "Secondary"}]}

{}