Multiple information disclosure vulnerabilities in Juniper Networks Junos OS Evolved allow a local, authenticated user with shell access the ability to view sensitive configuration information, such as the hashed values of login passwords and shared secrets. The information provided is similar to the output from 'show config system login', which is typically restricted to the super-user class. The log files are readable by any authenticated user with shell access.
 

One or more of these issues affect all versions of Junos OS Evolved prior to 19.3R1.
 

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
 

This issue was found during internal product security testing or research.
 

The issues addressed in this advisory include:

The following software releases have been updated to resolve these specific issues: 19.3R1-EVO and all subsequent releases.

This issue is being tracked as  1406193 ,  1406189 ,  1406195 ,  1406191  and  1406239 .
 

• Disallow unprivileged authenticated users access to Junos shell.
• Limit access to the Junos OS shell to only trusted system administrators.

​2020-04-08: Initial publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team