Reg story prompts fresh security bulletin, review of Juniper Networks' CVE process

Juniper Networks has disclosed separate vulnerabilities it was previously accused of concealing, and apologized to customers for the error in communication. The update, which happened late last week, comes hot on the heels of reporting from El Reg that highlighted how multiple security vendors were accused of bending the rules when it came to assigning CVEs for vulnerabilities in their products. The four vulnerabilities reported to Juniper Networks by watchTowr researcher Aliz Hammond, which were later found to be missing individual CVEs, have now each been disclosed separately, per an out-of-cycle security advisory. Despite submitting four vulnerability reports in total, Juniper credited watchTowr with the discovery of just two. The two other CVEs were apparently fixed in the original batch of updates – watchTowr is thought to have just rediscovered them – but they each now have their own distinct CVE. The advisory details three separate missing authentication vulnerabilities, each carrying a 5.3 severity score, and an 8.8-severity cross-site scripting (XSS) flaw that could lead to code execution with admin privileges if exploited. The newly disclosed issues affect J-Web in Junos OS SRX Series and EX Series, and are tracked as: CVE-2024-21619 CVE-2023-36846 CVE-2024-21620 CVE-2023-36851 "Multiple vulnerabilities in the J-Web component of Juniper Networks Junos OS on SRX Series and EX Series have been resolved through the application of specific fixes to address each vulnerab...