CVE-2025-59976: Junos Space: Arbitrary file download vulnerability in web interface
An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59976?
CVE-2025-59976 has a high severity rating due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2025-59976?
To fix CVE-2025-59976, update your Junos Space software to a version later than 24.1R3.
What systems are affected by CVE-2025-59976?
CVE-2025-59976 affects Juniper Networks Junos Space versions up to 24.1R3.
What type of attack does CVE-2025-59976 facilitate?
CVE-2025-59976 facilitates an arbitrary file download attack through crafted GET requests by authenticated users.
Can CVE-2025-59976 be exploited remotely?
Yes, CVE-2025-59976 can be exploited remotely by network-based authenticated attackers.