A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information.
When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information.
This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
* All versions earlier than 20.4R3-S9;
* 21.2 versions earlier than 21.2R3-S7;
* 21.3 versions earlier than 21.3R3-S5;
* 21.4 versions earlier than 21.4R3-S6;
* 22.1 versions earlier than 22.1R3-S5;
* 22.2 versions earlier than 22.2R3-S3;
* 22.3 versions earlier than 22.3R3-S2;
* 22.4 versions earlier than 22.4R3;
* 23.2 versions earlier than 23.2R1-S2, 23.2R2.
References
| Link | Resource |
|---|---|
| https://supportportal.juniper.net/JSA76390 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
No history.
Information
Published : 2024-01-25 23:15
Updated : 2024-01-31 23:46
NVD link : CVE-2024-21619
Mitre link : CVE-2024-21619
CVE.ORG link : CVE-2024-21619
JSON object : View
Products Affected
juniper
- ex8200-vc
- ex4300-48tdc-afi
- srx320
- srx1400
- ex4300_multigigabit
- srx4100
- ex4300-32f
- ex2300-24p
- ex4300-24t
- ex2300-24t
- srx5800
- ex2300-48t
- srx4000
- ex4300-48mp-s
- srx100
- ex4550\/vc
- ex2300
- ex4300-32f-dc
- ex4300-48p
- ex4100_multigigabit
- ex4300-24p-s
- ex9253
- ex4300-48p-s
- ex8200
- ex4300
- ex4300-mp
- ex2300-48p
- ex3300
- ex4300-24p
- srx240m
- ex9250
- srx4300
- ex4300-48t-dc
- ex8208
- ex4400-24x
- ex2300-48mp
- ex3200
- ex4300-48mp
- ex2200-vc
- ex4300-24t-s
- ex4300-48t-afi
- ex4300-48tdc
- ex2300-c
- ex4600
- ex4550-vc
- ex4400_multigigabit
- srx380
- ex2200
- srx550m
- srx345
- ex6200
- ex4300-32f-s
- ex9204
- srx300
- ex3300-vc
- ex4300-48tafi
- ex4100-f
- ex4200
- ex8216
- srx5400
- srx4600
- ex4300-48t-dc-afi
- srx550_hm
- ex3400
- ex4550
- srx550
- srx4700
- ex4500
- ex4600-vc
- ex4200-vc
- srx110
- srx340
- srx1500
- ex9214
- ex2300m
- srx240
- ex4500-vc
- ex4400
- srx5000
- srx3600
- junos
- srx1600
- ex4300-48t
- ex9200
- ex2200-c
- srx4200
- ex4650
- ex4300-48t-s
- srx2300
- ex_redundant_power_system
- ex2300-24mp
- srx650
- ex4300m
- ex_rps
- ex2300_multigigabit
- srx5600
- ex4100
- srx3400
- ex6210
- srx240h2
- ex9208
- srx220
- ex4300-vc
- ex9251
- srx210