An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to root over the target device. This issue affects: Juniper Networks Junos OS All versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2, 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2;
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Juniper |
|
Configuration 1 [-]
|
No data.
No data.
Fixes
Solution
The following software releases have been updated to resolve this specific issue: 18.3R3-S5, 18.4R3-S9, 19.1R3-S6, 19.2R3-S3, 19.3R3-S3, 19.4R3-S5, 20.1R3-S1, 20.2R3-S2, 20.3R3-S1, 20.4R3, 21.1R2, 21.1R3, 21.2R1-S1, 21.2R2, 21.3R1, and all subsequent releases.
Workaround
To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted administrative networks, hosts and users. Alternatively, J-Web can be disabled.
References
| Link | Providers |
|---|---|
| https://kb.juniper.net/JSA11237 |
|
History
Mon, 16 Sep 2024 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root. | Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root. |
MITRE
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2024-09-16T20:47:42.111Z
Reserved: 2021-04-15T00:00:00
Link: CVE-2021-31372
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-10-19T19:15:10.337
Modified: 2024-11-21T06:05:32.397
Link: CVE-2021-31372
Redhat
No data.
OpenCVE Enrichment
No data.