Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFjNTUtdm0zai03NGdw

JSNAPy allows unprivileged local users to alter files under the directory

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.

Permalink: https://github.com/advisories/GHSA-qc55-vm3j-74gp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFjNTUtdm0zai03NGdw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 6 years ago
Updated: 2 months ago

CVSS Score: 5.5
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-qc55-vm3j-74gp, CVE-2018-0023
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-0023
• https://github.com/advisories/GHSA-qc55-vm3j-74gp
• https://kb.juniper.net/JSA10856
• https://github.com/pypa/advisory-database/tree/main/vulns/jsnapy/PYSEC-2018-84.yaml
• https://web.archive.org/web/20200227125151/http://www.securityfocus.com/bid/103745

Blast Radius: 9.4

Affected Packages