Description
A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information.

When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
* All versions earlier than 20.4R3-S9;
* 21.2 versions earlier than 21.2R3-S7;
* 21.3 versions earlier than 21.3R3-S5;
* 21.4 versions earlier than 21.4R3-S6;
* 22.1 versions earlier than 22.1R3-S5;
* 22.2 versions earlier than 22.2R3-S3;
* 22.3 versions earlier than 22.3R3-S2;
* 22.4 versions earlier than 22.4R3;
* 23.2 versions earlier than 23.2R1-S2, 23.2R2.


Published: 2024-01-25
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7*, 21.3R3-S5, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases. *Pending Publication


Vendor Workaround

Disable J-Web, or limit access to only trusted hosts.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-19267 A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information. When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S6; * 22.1 versions earlier than 22.1R3-S5; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.
References
History

Tue, 17 Jun 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Subscriptions

Juniper Ex2200 Ex2200-c Ex2200-vc Ex2300 Ex2300-24mp Ex2300-24p Ex2300-24t Ex2300-48mp Ex2300-48p Ex2300-48t Ex2300-c Ex2300 Multigigabit Ex2300m Ex3200 Ex3300 Ex3300-vc Ex3400 Ex4100 Ex4100-f Ex4100 Multigigabit Ex4200 Ex4200-vc Ex4300 Ex4300-24p Ex4300-24p-s Ex4300-24t Ex4300-24t-s Ex4300-32f Ex4300-32f-dc Ex4300-32f-s Ex4300-48mp Ex4300-48mp-s Ex4300-48p Ex4300-48p-s Ex4300-48t Ex4300-48t-afi Ex4300-48t-dc Ex4300-48t-dc-afi Ex4300-48t-s Ex4300-48tafi Ex4300-48tdc Ex4300-48tdc-afi Ex4300-mp Ex4300-vc Ex4300 Multigigabit Ex4300m Ex4400 Ex4400-24x Ex4400 Multigigabit Ex4500 Ex4500-vc Ex4550 Ex4550-vc Ex4550\/vc Ex4600 Ex4600-vc Ex4650 Ex6200 Ex6210 Ex8200 Ex8200-vc Ex8208 Ex8216 Ex9200 Ex9204 Ex9208 Ex9214 Ex9250 Ex9251 Ex9253 Ex Redundant Power System Ex Rps Junos Srx100 Srx110 Srx1400 Srx1500 Srx1600 Srx210 Srx220 Srx2300 Srx240 Srx240h2 Srx240m Srx300 Srx320 Srx340 Srx3400 Srx345 Srx3600 Srx380 Srx4000 Srx4100 Srx4200 Srx4300 Srx4600 Srx4700 Srx5000 Srx5400 Srx550 Srx550 Hm Srx550m Srx5600 Srx5800 Srx650
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2025-06-17T21:19:30.229Z

Reserved: 2023-12-27T19:38:25.710Z

Link: CVE-2024-21619

cve-icon Vulnrichment

Updated: 2024-08-01T22:27:35.795Z

cve-icon NVD

Status : Modified

Published: 2024-01-25T23:15:09.467

Modified: 2024-11-21T08:54:44.270

Link: CVE-2024-21619

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses