U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database

Vulnerability Change Records for CVE-2024-39532

Change History

CVE Modified by Juniper Networks, Inc. 1/07/2025 4:15:11 PM

Action Type Old Value New Value
Changed Description 
An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information.

When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information.
This issue affects:

Junos OS:



  *  All versions before 22.1R2-S2,
  *  22.1R3 and later versions,
  *  22.2 versions before 22.2R2-S1, 22.2R3,
  *  22.3 versions before 22.3R1-S2, 22.3R2;




Junos OS Evolved:



  *  All versions before before 22.1R3-EVO,
  *  22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO,
  *  22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.
 
An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information.

When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information.
This issue affects:

Junos OS:



  *  All versions before 21.2R3-S9;
  *  

21.4 versions before 21.4R3-S9;

  *  22.2 versions before 22.2R2-S1, 22.2R3;
  *  22.3 versions before 22.3R1-S1, 22.3R2;




Junos OS Evolved:



  *  All versions before before 22.1R3-EVO;
  *  22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO;
  *  22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.
Removed CVSS V4.0 
AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X