title: Junos OS Evolved: objmon logs may leak sensitive information
description: A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affects all versions of Junos OS Evolved prior to 19.1R1.
problem types: CWE-532 Information Exposure Through Log Files
affected:
{
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 19.1R1-EVO, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: 19.1R1-EVO, 19.2R2-EVO, and all subsequent releases.
workarounds: Limit access to the Junos OS shell to only trusted system administrators with a need for access below the Junos CLI.