title: Junos OS Evolved: Configd leaks hashes via log file and is world readable
description: A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Evolved prior to 19.3R1.
problem types: CWE-664 Improper Control of a Resource Through its Lifetime
affected:
{
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 19.3R1-EVO, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: 19.3R1-EVO  and all subsequent releases.
workarounds: There are no viable workarounds for this issue.