CVE-2021-0231: Junos OS: SRX, vSRX Series: J-Web Path traversal vulnerability in SRX and vSRX Series leads to information disclosure.

Published Apr 22, 2021

Updated

A path traversal vulnerability in the Juniper Networks SRX and vSRX Series may allow an authenticated J-web user to read sensitive system files. This issue affects Juniper Networks Junos OS on SRX and vSRX Series: 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R2-S4, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R1-S3, 20.2R2; This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.

Affected Software

38 affected components

Juniper Junos=19.3

Juniper Junos=19.3-r1

Juniper Junos=19.3-r1-s1

Juniper Junos=19.3-r2

Juniper Junos=19.3-r2-s1

Juniper Junos=19.3-r2-s2

Juniper Junos=19.3-r2-s3

Juniper Junos=19.3-r2-s4

Juniper Junos=19.3-r2-s5

Juniper Junos=19.3-r3

Juniper Junos=19.4-r1

Juniper Junos=19.4-r1-s1

Juniper Junos=19.4-r1-s2

Juniper Junos=19.4-r2

Juniper Junos=19.4-r2-s1

Juniper Junos=19.4-r2-s2

Juniper Junos=19.4-r2-s3

Juniper Junos=20.1-r1

Juniper Junos=20.1-r1-s1

Juniper Junos=20.1-r1-s2

Juniper Junos=20.1-r1-s3

Juniper Junos=20.2-r1

Juniper Junos=20.2-r1-s1

Juniper Junos=20.2-r1-s2

Juniper vSRX

Juniper SRX1500

Juniper SRX300

Juniper SRX320

Juniper SRX340

Juniper SRX345

Juniper Srx380

Juniper SRX4100

Juniper SRX4200

Juniper SRX4600

Juniper SRX5400

Juniper SRX550

Juniper SRX5600

Juniper SRX5800

Remediation

Information

The following software releases have been updated to resolve this specific issue: 19.3R2-S6, 19.3R3-S1, 19.4R2-S4, 19.4R3, 20.1R1-S4, 20.1R2, 20.2R1-S3, 20.2R2, 20.3R1, and all subsequent releases.

Event History

Apr 22, 2021

CVE Published

via MITRE·07:36 PM

Data Sourced

via MITRE·07:36 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-0231?

CVE-2021-0231 is a path traversal vulnerability in the Juniper Networks SRX and vSRX Series that may allow an authenticated J-web user to read sensitive system files.

Which Junos OS versions are affected by CVE-2021-0231?

Junos OS versions 19.3 prior to 19.3R2-S6, 19.3R3-S1 and 19.4 prior to 19.4R2-S4, 19.4R3 are affected by CVE-2021-0231.

How can an authenticated J-web user exploit CVE-2021-0231?

An authenticated J-web user can exploit CVE-2021-0231 by performing a path traversal attack to read sensitive system files.

What is the severity of CVE-2021-0231?

CVE-2021-0231 has a severity score of 6.5 (medium).

Where can I find more information about CVE-2021-0231?

You can find more information about CVE-2021-0231 in the Juniper Networks Security Advisories page.