Session Smart Routerに管理者権限奪取の脆弱性、修正版あり
Summary
Juniper NetworksのSession Smart Routerに、認証なしで管理者権限を取られる脆弱性が見つかりました。Mist/Conductorに未接続の機器を持つ組織は、版を確認して修正版へ更新してください。接続済みの機器は悪用できなくなると説明されています。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Juniper NetworksのSession Smart Routerに、認証なしで管理者権限を取られる脆弱性が見つかりました。Mist/Conductorに未接続の機器を持つ組織は、版を確認して修正版へ更新してください。接続済みの機器は悪用できなくなると説明されています。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Juniper Networks | Session Smart Router |
< 7.0.5 ≥ 7.1.0, < 7.1.7 ≥ 7.2.0, < 7.2.3 |
7.0.5 7.1.7 7.2.3 |
Original description The description as published by the source.
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
Source: Security Online NVD GitHub Advisory
References
- SECURITYONLINE Juniper Fixes 18 Session Smart Router Vulnerabilities, Two Rated CVSS 9.8
- web supportportal.juniper.net
- web nvd.nist.gov
- web github.com