CVE-2021-31381
Assigner: juniper
Published: 2021-10-13T00:00:00
State: PUBLISHED
affected: product: SRC Series
vendor: Juniper Networks
versions: lessThan: 4.12.0R5
status: affected
version: unspecified
versionType: custom
lessThan: 4.13.0R3
status: affected
version: 4.13.0
versionType: custom
datePublic: 2021-10-13T00:00:00
descriptions: value: A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.
exploits: value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-16
description: CWE-16 Configuration
type: CWE
descriptions: cweId: CWE-200
description: CWE-200 Information Exposure
type: CWE
solutions: value: The following software releases have been updated to resolve this specific issue: 4.12.0R5, 4.13.0R3, and all subsequent releases.

source: advisory: JSA11248
defect: 1487223
discovery: USER
title: SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files
workarounds: value: There are no viable workarounds for this issue.

To reduce the risk of exploitation utilize common security BCPs to limit the exploitable surface by limiting access to network and device to trusted systems, administrators, networks and hosts.
x_generator: engine: Vulnogram 0.0.9