CVE-2021-31384

Katalog CVE

CVSS 10.0 · Critical EPSS 1,2%

Kerentanan Improper Authorization pada juniper junos. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

Rincian

Terbit di NVD

19 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-862: Missing Authorization
CWE-939: Improper Authorization in Handler for Custom URL Scheme
CWE-1220: Insufficient Granularity of Access Control

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11252 advisory vendor
• https://kb.juniper.net/ permissions required