Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction Required
No CVSS v3.0
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
The EPSS score is 0.00357.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
Juniper
Subscribe
|
Csrx
Subscribe
Ex2200
Subscribe
Ex2200-c
Subscribe
Ex2300
Subscribe
Ex2300-c
Subscribe
Ex3200
Subscribe
Ex3300
Subscribe
Ex3400
Subscribe
Ex4200
Subscribe
Ex4300
Subscribe
Ex4500
Subscribe
Ex4550
Subscribe
Ex4600
Subscribe
Ex4650
Subscribe
Ex6210
Subscribe
Ex8208
Subscribe
Ex8216
Subscribe
Ex9204
Subscribe
Ex9208
Subscribe
Ex9214
Subscribe
Ex9251
Subscribe
Ex9253
Subscribe
Junos
Subscribe
Srx100
Subscribe
Srx110
Subscribe
Srx1400
Subscribe
Srx1500
Subscribe
Srx210
Subscribe
Srx220
Subscribe
Srx240
Subscribe
Srx300
Subscribe
Srx320
Subscribe
Srx340
Subscribe
Srx3400
Subscribe
Srx345
Subscribe
Srx3600
Subscribe
Srx4100
Subscribe
Srx4200
Subscribe
Srx4600
Subscribe
Srx5400
Subscribe
Srx550
Subscribe
Srx550 Hm
Subscribe
Srx5600
Subscribe
Srx5800
Subscribe
Srx650
Subscribe
Vsrx
Subscribe
|
Configuration 1 [-]
| AND |
|
Configuration 2 [-]
| AND |
|
Configuration 3 [-]
|
Configuration 4 [-]
|
Configuration 5 [-]
| AND |
|
Configuration 6 [-]
|
Configuration 7 [-]
|
Configuration 8 [-]
|
Configuration 9 [-]
|
Configuration 10 [-]
|
Configuration 11 [-]
|
Configuration 12 [-]
|
Configuration 13 [-]
|
Configuration 14 [-]
|
Configuration 15 [-]
|
Configuration 16 [-]
|
Configuration 17 [-]
|
No data.
No data.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2019-0869 | A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S5; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2. |
Solution
The following software releases have been updated to resolve this specific issue: 12.3R12-S15*, 12.3X48-D85, 14.1X53-D51, 15.1F6-S13, 15.1R7-S5, 15.1X49-D180, 15.1X53-D238, 16.1R4-S13, 16.1R7-S5, 16.2R2-S10, 17.1R3-S1, 17.2R2-S8, 17.2R3-S3, 17.3R3-S5, 17.4R2-S8, 17.4R3*, 18.1R3-S8*, 18.2R3, 18.3R3, 18.4R2, 19.1R1-S2, 19.1R2, 19.2R1, and all subsequent releases. *pending publication
Workaround
Use access control lists or firewall filters to limit access to Junos J-Web interface to only trusted users and networks to reduce risks of exploitation of this vulnerability. Using common BCPs of safe web browsing such as not clicking on links in email or other media would reduce risks of exploitation of this vulnerability. Disabling J-Web would completely prevent any exploitation of this issue.
| Link | Providers |
|---|---|
| https://kb.juniper.net/JSA10961 |
|
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2024-09-16T22:50:43.676Z
Reserved: 2018-10-11T00:00:00
Link: CVE-2019-0062
No data.
Status : Modified
Published: 2019-10-09T20:15:17.223
Modified: 2024-11-21T04:16:10.040
Link: CVE-2019-0062
No data.
OpenCVE Enrichment
No data.
EUVD