Lucene search

[email protected]CVE-2019-0039

HistoryApr 10, 2019 - 8:29 p.m.

CVE-2019-0039

2019-04-1020:29:00

CWE-307

[email protected]

web.nvd.nist.gov

cve-2019-0039

juniper networks

junos os

rest api

brute force attacks

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.2%

JSON

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.

Affected configurations

NVD

Node

juniperjunosRange14.1x53–14.1x53-d49

juniperjunosRange15.1–15.1f6-s12

juniperjunosRange15.1x49–15.1x49-d160

juniperjunosRange15.1x53–15.1x53-d236

juniperjunosRange16.1–16.1r3-s10

juniperjunosRange16.1x65–16.1x65-d49

juniperjunosRange16.2–16.2r2-s7

juniperjunosRange17.1–17.1r2-s10

juniperjunosRange17.2–17.2r1-s8

juniperjunosRange17.3–17.3r3-s2

juniperjunosRange17.4–17.4r1-s6

juniperjunosRange18.1–18.1r2-s4

juniperjunosRange18.2–18.2r1-s5

juniperjunosRange18.2x75–18.2x75-d30

juniperjunosRange18.3–18.3r1-s1

CPENameOperatorVersion
juniper:junosjuniper junoslt14.1x53-d49
juniper:junosjuniper junoslt15.1f6-s12
juniper:junosjuniper junoslt15.1x49-d160
juniper:junosjuniper junoslt15.1x53-d236
juniper:junosjuniper junoslt16.1r3-s10
juniper:junosjuniper junoslt16.1x65-d49
juniper:junosjuniper junoslt16.2r2-s7
juniper:junosjuniper junoslt17.1r2-s10
juniper:junosjuniper junoslt17.2r1-s8
juniper:junosjuniper junoslt17.3r3-s2

CPE	Name	Operator	Version
juniper:junos	juniper junos	lt	14.1x53-d49
juniper:junos	juniper junos	lt	15.1f6-s12
juniper:junos	juniper junos	lt	15.1x49-d160
juniper:junos	juniper junos	lt	15.1x53-d236
juniper:junos	juniper junos	lt	16.1r3-s10
juniper:junos	juniper junos	lt	16.1x65-d49
juniper:junos	juniper junos	lt	16.2r2-s7
juniper:junos	juniper junos	lt	17.1r2-s10
juniper:junos	juniper junos	lt	17.2r1-s8
juniper:junos	juniper junos	lt	17.3r3-s2

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "14.1X53-D49",
        "status": "affected",
        "version": "14.1X53",
        "versionType": "custom"
      },
      {
        "lessThan": "15.1F6-S12, 15.1R7-S3",
        "status": "affected",
        "version": "15.1",
        "versionType": "custom"
      },
      {
        "lessThan": "15.1X49-D160",
        "status": "affected",
        "version": "15.1X49",
        "versionType": "custom"
      },
      {
        "lessThan": "15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69",
        "status": "affected",
        "version": "15.1X53",
        "versionType": "custom"
      },
      {
        "lessThan": "16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3",
        "status": "affected",
        "version": "16.1",
        "versionType": "custom"
      },
      {
        "lessThan": "16.1X65-D49",
        "status": "affected",
        "version": "16.1X65",
        "versionType": "custom"
      },
      {
        "lessThan": "16.2R2-S7",
        "status": "affected",
        "version": "16.2",
        "versionType": "custom"
      },
      {
        "lessThan": "17.1R2-S10, 17.1R3",
        "status": "affected",
        "version": "17.1",
        "versionType": "custom"
      },
      {
        "lessThan": "17.2R1-S8, 17.2R3-S1",
        "status": "affected",
        "version": "17.2",
        "versionType": "custom"
      },
      {
        "lessThan": "17.3R3-S2",
        "status": "affected",
        "version": "17.3",
        "versionType": "custom"
      },
      {
        "lessThan": "17.4R1-S6, 17.4R2-S2",
        "status": "affected",
        "version": "17.4",
        "versionType": "custom"
      },
      {
        "lessThan": "18.1R2-S4, 18.1R3-S1",
        "status": "affected",
        "version": "18.1",
        "versionType": "custom"
      },
      {
        "lessThan": "18.2R1-S5",
        "status": "affected",
        "version": "18.2",
        "versionType": "custom"
      },
      {
        "lessThan": "18.2X75-D30",
        "status": "affected",
        "version": "18.2X75",
        "versionType": "custom"
      },
      {
        "lessThan": "18.3R1-S1",
        "status": "affected",
        "version": "18.3",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107899

kb.juniper.net/JSA10928

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.2%

JSON

Related for CVE-2019-0039

nvd1 nessus1 cvelist1 prion1