PT-2021-5409 · Juniper Networks · Junos

Andy Coles · Published 2021-10-13 · Updated 2021-10-25 · CVE-2021-31385

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 12.3 prior to 12.3R12-S19 Juniper Networks Junos OS versions 15.1 prior to 15.1R7-S10 Juniper Networks Junos OS versions 18.3 prior to 18.3R3-S5 Juniper Networks Junos OS versions 18.4 prior to 18.4R3-S9 Juniper Networks Junos OS versions 19.1 prior to 19.1R3-S6 Juniper Networks Junos OS versions 19.2 prior to 19.2R1-S7, 19.2R3-S3 Juniper Networks Junos OS versions 19.3 prior to 19.3R3-S3 Juniper Networks Junos OS versions 19.4 prior to 19.4R3-S5 Juniper Networks Junos OS versions 20.1 prior to 20.1R2-S2, 20.1R3-S1 Juniper Networks Junos OS versions 20.2 prior to 20.2R3-S2 Juniper Networks Junos OS versions 20.3 prior to 20.3R3 Juniper Networks Junos OS versions 20.4 prior to 20.4R2-S1, 20.4R3 Juniper Networks Junos OS versions 21.1 prior to 21.1R1-S1, 21.1R2

Description An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') issue in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue can be exploited by a remote attacker.

Recommendations For Juniper Networks Junos OS versions 12.3 prior to 12.3R12-S19, update to version 12.3R12-S19 or later. For Juniper Networks Junos OS versions 15.1 prior to 15.1R7-S10, update to version 15.1R7-S10 or later. For Juniper Networks Junos OS versions 18.3 prior to 18.3R3-S5, update to version 18.3R3-S5 or later. For Juniper Networks Junos OS versions 18.4 prior to 18.4R3-S9, update to version 18.4R3-S9 or later. For Juniper Networks Junos OS versions 19.1 prior to 19.1R3-S6, update to version 19.1R3-S6 or later. For Juniper Networks Junos OS versions 19.2 prior to 19.2R1-S7, 19.2R3-S3, update to version 19.2R1-S7, 19.2R3-S3 or later. For Juniper Networks Junos OS versions 19.3 prior to 19.3R3-S3, update to version 19.3R3-S3 or later. For Juniper Networks Junos OS versions 19.4 prior to 19.4R3-S5, update to version 19.4R3-S5 or later. For Juniper Networks Junos OS versions 20.1 prior to 20.1R2-S2, 20.1R3-S1, update to version 20.1R2-S2, 20.1R3-S1 or later. For Juniper Networks Junos OS versions 20.2 prior to 20.2R3-S2, update to version 20.2R3-S2 or later. For Juniper Networks Junos OS versions 20.3 prior to 20.3R3, update to version 20.3R3 or later. For Juniper Networks Junos OS versions 20.4 prior to 20.4R2-S1, 20.4R3, update to version 20.4R2-S1, 20.4R3 or later. For Juniper Networks Junos OS versions 21.1 prior to 21.1R1-S1, 21.1R2, update to version 21.1R1-S1, 21.1R2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-06251

CVE-2021-31385

Affected Products

Junos

References · 5

• https://kb.juniper.net/JSA11253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31385 · Security Note
• https://bdu.fstec.ru/vul/2021-06251 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31385 · Vendor Advisory
• https://t.me/cibsecurity/30839 · Telegram Post