6.9

CVE-2024-30390

Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced

An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service (DoS) to the management plane.

When an incoming connection was blocked because it exceeded the connections-per-second rate-limit, the system doesn't consider existing connections anymore for subsequent connection attempts so that the connection limit can be exceeded.
This issue affects Junos OS Evolved:



  *  All versions before 21.4R3-S4-EVO,
  *  22.1-EVO versions before 22.1R3-S3-EVO,
  *  22.2-EVO versions before 22.2R3-S2-EVO, 
  *  22.3-EVO versions before 22.3R2-S1-EVO, 22.3R3-EVO.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Os Evolved Version < 21.4
Juniper ≫ Junos Os Evolved Version21.4 Update-
Juniper ≫ Junos Os Evolved Version21.4 Updater1
Juniper ≫ Junos Os Evolved Version21.4 Updater1-s1
Juniper ≫ Junos Os Evolved Version21.4 Updater1-s2
Juniper ≫ Junos Os Evolved Version21.4 Updater2
Juniper ≫ Junos Os Evolved Version21.4 Updater2-s1
Juniper ≫ Junos Os Evolved Version21.4 Updater2-s2
Juniper ≫ Junos Os Evolved Version21.4 Updater3
Juniper ≫ Junos Os Evolved Version21.4 Updater3-s1
Juniper ≫ Junos Os Evolved Version21.4 Updater3-s2
Juniper ≫ Junos Os Evolved Version21.4 Updater3-s3
Juniper ≫ Junos Os Evolved Version22.1 Update-
Juniper ≫ Junos Os Evolved Version22.1 Updater1
Juniper ≫ Junos Os Evolved Version22.1 Updater1-s1
Juniper ≫ Junos Os Evolved Version22.1 Updater1-s2
Juniper ≫ Junos Os Evolved Version22.1 Updater2
Juniper ≫ Junos Os Evolved Version22.1 Updater2-s1
Juniper ≫ Junos Os Evolved Version22.1 Updater3
Juniper ≫ Junos Os Evolved Version22.1 Updater3-s1
Juniper ≫ Junos Os Evolved Version22.1 Updater3-s2
Juniper ≫ Junos Os Evolved Version22.2 Update-
Juniper ≫ Junos Os Evolved Version22.2 Updater1
Juniper ≫ Junos Os Evolved Version22.2 Updater1-s1
Juniper ≫ Junos Os Evolved Version22.2 Updater1-s2
Juniper ≫ Junos Os Evolved Version22.2 Updater2
Juniper ≫ Junos Os Evolved Version22.2 Updater2-s1
Juniper ≫ Junos Os Evolved Version22.2 Updater2-s2
Juniper ≫ Junos Os Evolved Version22.2 Updater3
Juniper ≫ Junos Os Evolved Version22.2 Updater3-s1
Juniper ≫ Junos Os Evolved Version22.3 Update-
Juniper ≫ Junos Os Evolved Version22.3 Updater1
Juniper ≫ Junos Os Evolved Version22.3 Updater1-s1
Juniper ≫ Junos Os Evolved Version22.3 Updater1-s2
Juniper ≫ Junos Os Evolved Version22.3 Updater2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.08% 0.232
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
sirt@juniper.net 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
sirt@juniper.net 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.