Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. jsnapy
  4. ›
  5. CVE-2018-0023

CVE-2018-0023: JSNAPy allows unprivileged local users to alter files under the directory

July 12, 2018 (updated September 24, 2024)

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.

References

  • github.com/Juniper/jsnapy
  • github.com/advisories/GHSA-qc55-vm3j-74gp
  • github.com/pypa/advisory-database/tree/main/vulns/jsnapy/PYSEC-2018-84.yaml
  • kb.juniper.net/JSA10856
  • nvd.nist.gov/vuln/detail/CVE-2018-0023
  • web.archive.org/web/20200227125151/http://www.securityfocus.com/bid/103745

Code Behaviors & Features

Detect and mitigate CVE-2018-0023 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.3.0

Fixed versions

  • 1.3.0

Solution

Upgrade to version 1.3.0 or above.

Impact 5.5 MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-276: Incorrect Default Permissions

Source file

pypi/jsnapy/CVE-2018-0023.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:58 +0000.