CVE-2019-0016: Junos Space: Authenticated user able to delete devices without delete device privileges

Published Jan 15, 2019

Updated

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

Affected Software

23 affected components

Juniper Junos Space=13.3-r1

Juniper Junos Space=13.3-r2

Juniper Junos Space=13.3-r3

Juniper Junos Space=13.3-r4

Juniper Junos Space=14.1

Juniper Junos Space=14.1-r1

Juniper Junos Space=14.1-r2

Juniper Junos Space=14.1-r3

Juniper Junos Space=15.1-r1

Juniper Junos Space=15.1-r2

Juniper Junos Space=15.1-r3

Juniper Junos Space=15.1-r4

Juniper Junos Space=15.2

Juniper Junos Space=15.2-r1

Juniper Junos Space=15.2-r2

Juniper Junos Space=16.1

Juniper Junos Space=16.1-r1

Juniper Junos Space=16.1-r2

Juniper Junos Space=16.1-r3

Juniper Junos Space=17.1-r1

Juniper Junos Space=17.2-r1.4

Juniper Junos Space=18.1-r1

Juniper Junos Space=18.2-r1

Event History

Jan 15, 2019

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0016?

CVE-2019-0016 has a severity rating of high due to unauthorized device deletion risks.

How do I fix CVE-2019-0016?

To fix CVE-2019-0016, upgrade to the latest patched version of Junos Space as recommended by Juniper.

Who is affected by CVE-2019-0016?

CVE-2019-0016 affects authenticated users of Junos Space running specific versions listed in the advisory.

What versions of Junos Space are vulnerable to CVE-2019-0016?

Versions 13.3-r1 through 18.2-r1 of Junos Space are vulnerable to CVE-2019-0016.

What types of attacks does CVE-2019-0016 allow?

CVE-2019-0016 allows an attacker to delete devices from the database without proper privileges.