Executive Summary

Informations
Name CVE-2022-22156 First vendor Publication 2022-01-19
Vendor Cve Last vendor Modification 2022-01-26

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Overall CVSS Score 7.4
Base Score 7.4 Environmental Score 7.4
impact SubScore 5.2 Temporal Score 7.4
Exploitabality Sub Score 2.2
 
Attack Vector Network Attack Complexity High
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Cvss Base Score 5.8 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle (PitM) attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity and confidentiality of the device. The following command can be executed by an administrator via the CLI to refresh a script from a remote location, which is affected from this vulnerability: >request system scripts refresh-from (commit | event | extension-service | op | snmp) file filename url This issue affects: Juniper Networks Junos OS All versions prior to 18.4R2-S9, 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S7; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2; 21.1 versions prior to 21.1R1-S1, 21.1R2.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22156

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-358 Improperly Implemented Security Check for Standard
33 % CWE-300 Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
33 % CWE-295 Certificate Issues

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Hardware 1
Os 897

Sources (Detail)

Source Url
CONFIRM https://kb.juniper.net/JSA11264

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2022-10-11 13:12:15
  • Multiple Updates
2022-10-11 01:24:35
  • Multiple Updates
2022-08-25 02:07:28
  • Multiple Updates
2022-07-30 12:58:10
  • Multiple Updates
2022-04-22 02:00:00
  • Multiple Updates
2022-01-27 00:23:05
  • Multiple Updates
2022-01-26 21:23:02
  • Multiple Updates
2022-01-20 01:51:17
  • Multiple Updates
2022-01-20 01:51:15
  • Multiple Updates
2022-01-19 17:22:58
  • Multiple Updates
2022-01-19 09:23:08
  • First insertion