Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cnvd-2020-27195
Vulnerability from cnvd
Title: Juniper Networks Junos OS服务存在安全漏洞
Description:
Juniper Networks Junos OS是美国瞻博网络（Juniper Networks）公司的一套专用于该公司的硬件设备的网络操作系统。该操作系统提供了安全编程接口和Junos SDK。
Juniper Networks Junos OS中的J-Web和基于Web(HTTP/HTTPS)的服务存在安全漏洞。攻击者可利用该漏洞向httpd.log文件注入命令，读取文件或获取J-Web会话令牌。
Severity: 中
Patch Name: Juniper Networks Junos OS服务存在安全漏洞的补丁
Patch Description:
Juniper Networks Junos OS是美国瞻博网络（Juniper Networks）公司的一套专用于该公司的硬件设备的网络操作系统。该操作系统提供了安全编程接口和Junos SDK。
Juniper Networks Junos OS中的J-Web和基于Web(HTTP/HTTPS)的服务存在安全漏洞。攻击者可利用该漏洞向httpd.log文件注入命令，读取文件或获取J-Web会话令牌。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description:
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11021&actp=SUBSCRIPTION
Reference: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11021
Impacted products
| Name | ['Juniper Networks Junos OS 15.1', 'Juniper Networks Junos OS 14.1X53', 'Juniper Networks Junos OS 15.1X49', 'Juniper Networks Junos OS 12.3X48', 'Juniper Networks Junos OS 17.2', 'Juniper Networks Junos OS 17.3', 'Juniper Networks Junos OS 17.4', 'Juniper Networks Junos OS 18.1', 'Juniper Networks Junos OS 18.2', 'Juniper Networks Junos OS 18.3', 'Juniper Networks Junos OS 12.3', 'Juniper Networks Junos OS 19.1', 'Juniper Networks Junos OS 18.4', 'Juniper Networks Junos OS 19.2'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-1631"
}
},
"description": "Juniper Networks Junos OS\u662f\u7f8e\u56fd\u77bb\u535a\u7f51\u7edc\uff08Juniper Networks\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u8bbe\u5907\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u4e86\u5b89\u5168\u7f16\u7a0b\u63a5\u53e3\u548cJunos SDK\u3002\n\nJuniper Networks Junos OS\u4e2d\u7684J-Web\u548c\u57fa\u4e8eWeb(HTTP/HTTPS)\u7684\u670d\u52a1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411httpd.log\u6587\u4ef6\u6ce8\u5165\u547d\u4ee4\uff0c\u8bfb\u53d6\u6587\u4ef6\u6216\u83b7\u53d6J-Web\u4f1a\u8bdd\u4ee4\u724c\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11021\u0026actp=SUBSCRIPTION",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-27195",
"openTime": "2020-05-09",
"patchDescription": "Juniper Networks Junos OS\u662f\u7f8e\u56fd\u77bb\u535a\u7f51\u7edc\uff08Juniper Networks\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u8bbe\u5907\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u4e86\u5b89\u5168\u7f16\u7a0b\u63a5\u53e3\u548cJunos SDK\u3002\r\n\r\nJuniper Networks Junos OS\u4e2d\u7684J-Web\u548c\u57fa\u4e8eWeb(HTTP/HTTPS)\u7684\u670d\u52a1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411httpd.log\u6587\u4ef6\u6ce8\u5165\u547d\u4ee4\uff0c\u8bfb\u53d6\u6587\u4ef6\u6216\u83b7\u53d6J-Web\u4f1a\u8bdd\u4ee4\u724c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Juniper Networks Junos OS\u670d\u52a1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Juniper Networks Junos OS 15.1",
"Juniper Networks Junos OS 14.1X53",
"Juniper Networks Junos OS 15.1X49",
"Juniper Networks Junos OS 12.3X48",
"Juniper Networks Junos OS 17.2",
"Juniper Networks Junos OS 17.3",
"Juniper Networks Junos OS 17.4",
"Juniper Networks Junos OS 18.1",
"Juniper Networks Junos OS 18.2",
"Juniper Networks Junos OS 18.3",
"Juniper Networks Junos OS 12.3",
"Juniper Networks Junos OS 19.1",
"Juniper Networks Junos OS 18.4",
"Juniper Networks Junos OS 19.2"
]
},
"referenceLink": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11021",
"serverity": "\u4e2d",
"submitTime": "2020-04-29",
"title": "Juniper Networks Junos OS\u670d\u52a1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e"
}
CVE-2020-1631 (GCVE-0-2020-1631)
Vulnerability from cvelistv5
Published
2020-05-04 09:25
Modified
2025-07-30 01:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns "=*;*&" or "*%3b*&" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match "=*;*&|=*%3b*&" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match "=*;*&|=*%3b*&" user@device> show log httpd.log.1.gz | match "=*;*&|=*%3b*&" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.
References
| ▼ | URL | Tags |
|---|---|---|
| https://kb.juniper.net/JSA11021 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Juniper Networks | Junos OS |
Version: 12.3 < 12.3R12-S16 Version: 12.3X48 < 12.3X48-D101, 12.3X48-D105 Version: 14.1X53 < 14.1X53-D54 Version: 15.1 < 15.1R7-S7 Version: 15.1X49 < 15.1X49-D211, 15.1X49-D220 Version: 16.1 < 16.1R7-S8 Version: 17.2 < 17.2R3-S4 Version: 17.3 < 17.3R3-S8 Version: 17.4 < 17.4R2-S11, 17.4R3-S2 Version: 18.1 < 18.1R3-S10 Version: 18.2 < 18.2R2-S7, 18.2R3-S4 Version: 18.3 < 18.3R2-S4, 18.3R3-S2 Version: 18.4 < 18.4R1-S7, 18.4R3-S2 Version: 19.1 < 19.1R1-S5, 19.1R3-S1 Version: 19.2 < 19.2R2 Version: 19.3 < 19.3R2-S3, 19.3R3 Version: 19.4 < 19.4R1-S2, 19.4R2 Version: 20.1 < 20.1R1-S1, 20.1R2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:46:30.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kb.juniper.net/JSA11021"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-1631",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T12:53:09.940482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-03-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1631"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T01:45:42.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2022-03-25T00:00:00+00:00",
"value": "CVE-2020-1631 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Junos OS",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "12.3R12-S16",
"status": "affected",
"version": "12.3",
"versionType": "custom"
},
{
"lessThan": "12.3X48-D101, 12.3X48-D105",
"status": "affected",
"version": "12.3X48",
"versionType": "custom"
},
{
"lessThan": "14.1X53-D54",
"status": "affected",
"version": "14.1X53",
"versionType": "custom"
},
{
"lessThan": "15.1R7-S7",
"status": "affected",
"version": "15.1",
"versionType": "custom"
},
{
"lessThan": "15.1X49-D211, 15.1X49-D220",
"status": "affected",
"version": "15.1X49",
"versionType": "custom"
},
{
"lessThan": "16.1R7-S8",
"status": "affected",
"version": "16.1",
"versionType": "custom"
},
{
"lessThan": "17.2R3-S4",
"status": "affected",
"version": "17.2",
"versionType": "custom"
},
{
"lessThan": "17.3R3-S8",
"status": "affected",
"version": "17.3",
"versionType": "custom"
},
{
"lessThan": "17.4R2-S11, 17.4R3-S2",
"status": "affected",
"version": "17.4",
"versionType": "custom"
},
{
"lessThan": "18.1R3-S10",
"status": "affected",
"version": "18.1",
"versionType": "custom"
},
{
"lessThan": "18.2R2-S7, 18.2R3-S4",
"status": "affected",
"version": "18.2",
"versionType": "custom"
},
{
"lessThan": "18.3R2-S4, 18.3R3-S2",
"status": "affected",
"version": "18.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "18.4R2",
"status": "affected"
}
],
"lessThan": "18.4R1-S7, 18.4R3-S2",
"status": "affected",
"version": "18.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "19.1R2",
"status": "affected"
}
],
"lessThan": "19.1R1-S5, 19.1R3-S1",
"status": "affected",
"version": "19.1",
"versionType": "custom"
},
{
"lessThan": "19.2R2",
"status": "affected",
"version": "19.2",
"versionType": "custom"
},
{
"lessThan": "19.3R2-S3, 19.3R3",
"status": "affected",
"version": "19.3",
"versionType": "custom"
},
{
"lessThan": "19.4R1-S2, 19.4R2",
"status": "affected",
"version": "19.4",
"versionType": "custom"
},
{
"lessThan": "20.1R1-S1, 20.1R2",
"status": "affected",
"version": "20.1",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The examples of the config stanza affected by this issue:\n [system services web-management http]\n [system services web-management https]\n [security dynamic-vpn]"
}
],
"credits": [
{
"lang": "en",
"value": "The Juniper SIRT would like to would like to acknowledge and thank Laing Bian and Leishen Song (@rayh4c) of 360 ATA for reporting this issue."
}
],
"datePublic": "2020-04-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with \u0027world\u0027 readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user \u0027nobody\u0027, the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with \u0027world\u0027 readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device\u003e show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns \"=*;*\u0026\" or \"*%3b*\u0026\" in /var/log/httpd.log, using the following command: user@device\u003e show log httpd.log | match \"=*;*\u0026|=*%3b*\u0026\" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device\u003e show log httpd.log.0.gz | match \"=*;*\u0026|=*%3b*\u0026\" user@device\u003e show log httpd.log.1.gz | match \"=*;*\u0026|=*%3b*\u0026\" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-04T09:25:12.000Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kb.juniper.net/JSA11021"
}
],
"solutions": [
{
"lang": "en",
"value": "The following software releases have been updated to resolve this specific issue: 12.3R12-S16, 12.3X48-D101, 12.3X48-D105, 14.1X53-D54, 15.1X49-D211, 15.1X49-D220, 15.1R7-S7, 16.1R7-S8, 17.2R3-S4, 17.4R2-S11, 17.3R3-S8, 17.4R3-S2, 18.1R3-S10, 18.2R2-S7, 18.2R3-S4, 18.3R2-S4, 18.3R3-S2, 18.4R1-S7, 18.4R3-S2, 19.1R1-S5, 19.1R3-S1, 19.2R2, 19.3R2-S3, 19.3R3, 19.4R1-S2, 19.4R2, 20.1R1-S1, 20.1R2 and all subsequent releases.\n\nNote: At the time of this publication, the following fixed releases are available for customer download: 12.3X48-D101, 15.1X49-D211, 18.2R3-S4, 18.4R3-S2, and 20.1R1-S1, the remaining fixed releases will be available in future time.\n\n12.3X48-D101 \u0026 15.1X49-D211 releases can be downloaded from the below URLs:\n\n12.3X48-D101 :\nBranch SRX-Series Install Package (for SRX100H2, SRX110HE2, SRX210H2, SRX220H2, SRX240H2, SRX550, SRX650): junos-srxsme-12.3X48-D101-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107438.html\n MD5 = b822376f7a385e74499b186cf28c122b\n SHA-1 = e6138e45bf9d29e962468e6e114e537142d4cc0d\n SHA-256 = b21a9ae9f5d0b0ec25180682193faba7bf54e836fda0eb78babd3df843f90e6a\n \nSRX 1000/3000-Series Install Package : junos-srx1k3k-12.3X48-D101-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107436.html\n MD5 = b93229ea43f66b539f22ecc5a9be0f07\n SHA-1 = 2c625e9bc155b9fcb4c9a1a371bba473363ee6f0\n SHA-256 = 982434f9cde9492e1d80d14c43a7cdcc5261db15a11f65fa7c9881a0fc0cd3db\n \nSRX5000-Series Install Package: junos-srx5000-12.3X48-D101-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107437.html\n MD5 = 7dc73801b7680fda42d453d6d3d6f10c\n SHA-1 = 05f1eda5ec112c7e2afeebea4d47c007e0a8bd60\n SHA-256 = 88d40e4b6b949a5c656c2b5fffa3adb41fe4943fb3e5d9cfaa439e603889e839\n \n15.1X49-D211:\nSRX300 \u0026 SRX500-Series Install Package: junos-srxsme-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107439.html\n MD5 = dfd3428c7f83eb11142bbe32bac2a151\n SHA-1 = a22f0ead795c8afb0a4d59d1b9b785c83801cd65\n SHA-256 = dc42e24db0e2af7b2e6aaafdaa61f8e658fabc91c8a888efad586a5fbd2fa29a\n \nSRX1500 Install Package: junos-srxentedge-15.1X49-D211-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107442.html\n MD5 = 348f2fcd96b31d51b9d71147d09fabd8\n SHA-1 = cf8ee775ca1ca12706975fdd0748c1967732c2fe\n SHA-256 = 62d460ea531161936f0ac75fa4501bc6cadb700388bdb93b7e706a09e985eff5\n \nSRX4100 and SRX4200 Install Package: junos-srxmr-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107441.html\n MD5 = 55b4c96b05b5fd9595a8ee071dbbf438\n SHA-1 = ae6d7978964c3be6b632033b3616208e47653617\n SHA-256 = 20274c3b66d4b54471684a5f534abe0ba1d8bebabbb6f78f0028fcc275076df1\n \nSRX5000 Series Install Package: junos-srx5000-15.1X49-D211-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107440.html\n MD5 = b918fa5a341815ccdb230560539e8725\n SHA-1 = 38e912a55f1407e18e1bb8305f854fcd97c1adcb\n SHA-256 = c1aaafdd9b23a525236c414e4cf213542246326317070b5e98ac5cccc5fa1e72\n \nvSRX Upgrade TGZ: junos-vsrx-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107452.html\n MD5 = 55b4c96b05b5fd9595a8ee071dbbf438\n SHA-1 = ae6d7978964c3be6b632033b3616208e47653617\n SHA-256 = 20274c3b66d4b54471684a5f534abe0ba1d8bebabbb6f78f0028fcc275076df1"
}
],
"source": {
"advisory": "JSA11021",
"defect": [
"1499280"
],
"discovery": "EXTERNAL"
},
"title": "Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services",
"workarounds": [
{
"lang": "en",
"value": "There are no viable workarounds for this issue.\n\nIt is highly recommended to disable HTTP/HTTPS service and DVPN:\n user@device# deactivate system services web-management\n user@device# deactivate security dynamic-vpn (if DVPN is enabled)\n user@device# commit\nor allowing HTTP service only on from trusted hosts or networks (refer to https://kb.juniper.net/KB21265 for details on how to limite HTTP service)."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2020-04-27T16:00:00.000Z",
"ID": "CVE-2020-1631",
"STATE": "PUBLIC",
"TITLE": "Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "12.3",
"version_value": "12.3R12-S16"
},
{
"version_affected": "\u003c",
"version_name": "12.3X48",
"version_value": "12.3X48-D101, 12.3X48-D105"
},
{
"version_affected": "\u003c",
"version_name": "14.1X53",
"version_value": "14.1X53-D54"
},
{
"version_affected": "\u003c",
"version_name": "15.1",
"version_value": "15.1R7-S7"
},
{
"version_affected": "\u003c",
"version_name": "15.1X49",
"version_value": "15.1X49-D211, 15.1X49-D220"
},
{
"version_affected": "\u003c",
"version_name": "16.1",
"version_value": "16.1R7-S8"
},
{
"version_affected": "\u003c",
"version_name": "17.2",
"version_value": "17.2R3-S4"
},
{
"version_affected": "\u003c",
"version_name": "17.3",
"version_value": "17.3R3-S8"
},
{
"version_affected": "\u003c",
"version_name": "17.4",
"version_value": "17.4R2-S11, 17.4R3-S2"
},
{
"version_affected": "\u003c",
"version_name": "18.1",
"version_value": "18.1R3-S10"
},
{
"version_affected": "\u003c",
"version_name": "18.2",
"version_value": "18.2R2-S7, 18.2R3-S4"
},
{
"version_affected": "\u003c",
"version_name": "18.3",
"version_value": "18.3R2-S4, 18.3R3-S2"
},
{
"version_affected": "\u003c",
"version_name": "18.4",
"version_value": "18.4R1-S7, 18.4R3-S2"
},
{
"version_affected": "\u003e=",
"version_name": "18.4",
"version_value": "18.4R2"
},
{
"version_affected": "\u003c",
"version_name": "19.1",
"version_value": "19.1R1-S5, 19.1R3-S1"
},
{
"version_affected": "\u003e=",
"version_name": "19.1",
"version_value": "19.1R2"
},
{
"version_affected": "\u003c",
"version_name": "19.2",
"version_value": "19.2R2"
},
{
"version_affected": "\u003c",
"version_name": "19.3",
"version_value": "19.3R2-S3, 19.3R3"
},
{
"version_affected": "\u003c",
"version_name": "19.4",
"version_value": "19.4R1-S2, 19.4R2"
},
{
"version_affected": "\u003c",
"version_name": "20.1",
"version_value": "20.1R1-S1, 20.1R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "en",
"value": "The examples of the config stanza affected by this issue:\n [system services web-management http]\n [system services web-management https]\n [security dynamic-vpn]"
}
],
"credit": [
{
"lang": "eng",
"value": "The Juniper SIRT would like to would like to acknowledge and thank Laing Bian and Leishen Song (@rayh4c) of 360 ATA for reporting this issue."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with \u0027world\u0027 readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user \u0027nobody\u0027, the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with \u0027world\u0027 readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device\u003e show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns \"=*;*\u0026\" or \"*%3b*\u0026\" in /var/log/httpd.log, using the following command: user@device\u003e show log httpd.log | match \"=*;*\u0026|=*%3b*\u0026\" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device\u003e show log httpd.log.0.gz | match \"=*;*\u0026|=*%3b*\u0026\" user@device\u003e show log httpd.log.1.gz | match \"=*;*\u0026|=*%3b*\u0026\" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-73 External Control of File Name or Path"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA11021",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA11021"
}
]
},
"solution": [
{
"lang": "en",
"value": "The following software releases have been updated to resolve this specific issue: 12.3R12-S16, 12.3X48-D101, 12.3X48-D105, 14.1X53-D54, 15.1X49-D211, 15.1X49-D220, 15.1R7-S7, 16.1R7-S8, 17.2R3-S4, 17.4R2-S11, 17.3R3-S8, 17.4R3-S2, 18.1R3-S10, 18.2R2-S7, 18.2R3-S4, 18.3R2-S4, 18.3R3-S2, 18.4R1-S7, 18.4R3-S2, 19.1R1-S5, 19.1R3-S1, 19.2R2, 19.3R2-S3, 19.3R3, 19.4R1-S2, 19.4R2, 20.1R1-S1, 20.1R2 and all subsequent releases.\n\nNote: At the time of this publication, the following fixed releases are available for customer download: 12.3X48-D101, 15.1X49-D211, 18.2R3-S4, 18.4R3-S2, and 20.1R1-S1, the remaining fixed releases will be available in future time.\n\n12.3X48-D101 \u0026 15.1X49-D211 releases can be downloaded from the below URLs:\n\n12.3X48-D101 :\nBranch SRX-Series Install Package (for SRX100H2, SRX110HE2, SRX210H2, SRX220H2, SRX240H2, SRX550, SRX650): junos-srxsme-12.3X48-D101-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107438.html\n MD5 = b822376f7a385e74499b186cf28c122b\n SHA-1 = e6138e45bf9d29e962468e6e114e537142d4cc0d\n SHA-256 = b21a9ae9f5d0b0ec25180682193faba7bf54e836fda0eb78babd3df843f90e6a\n \nSRX 1000/3000-Series Install Package : junos-srx1k3k-12.3X48-D101-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107436.html\n MD5 = b93229ea43f66b539f22ecc5a9be0f07\n SHA-1 = 2c625e9bc155b9fcb4c9a1a371bba473363ee6f0\n SHA-256 = 982434f9cde9492e1d80d14c43a7cdcc5261db15a11f65fa7c9881a0fc0cd3db\n \nSRX5000-Series Install Package: junos-srx5000-12.3X48-D101-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107437.html\n MD5 = 7dc73801b7680fda42d453d6d3d6f10c\n SHA-1 = 05f1eda5ec112c7e2afeebea4d47c007e0a8bd60\n SHA-256 = 88d40e4b6b949a5c656c2b5fffa3adb41fe4943fb3e5d9cfaa439e603889e839\n \n15.1X49-D211:\nSRX300 \u0026 SRX500-Series Install Package: junos-srxsme-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107439.html\n MD5 = dfd3428c7f83eb11142bbe32bac2a151\n SHA-1 = a22f0ead795c8afb0a4d59d1b9b785c83801cd65\n SHA-256 = dc42e24db0e2af7b2e6aaafdaa61f8e658fabc91c8a888efad586a5fbd2fa29a\n \nSRX1500 Install Package: junos-srxentedge-15.1X49-D211-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107442.html\n MD5 = 348f2fcd96b31d51b9d71147d09fabd8\n SHA-1 = cf8ee775ca1ca12706975fdd0748c1967732c2fe\n SHA-256 = 62d460ea531161936f0ac75fa4501bc6cadb700388bdb93b7e706a09e985eff5\n \nSRX4100 and SRX4200 Install Package: junos-srxmr-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107441.html\n MD5 = 55b4c96b05b5fd9595a8ee071dbbf438\n SHA-1 = ae6d7978964c3be6b632033b3616208e47653617\n SHA-256 = 20274c3b66d4b54471684a5f534abe0ba1d8bebabbb6f78f0028fcc275076df1\n \nSRX5000 Series Install Package: junos-srx5000-15.1X49-D211-domestic.tgz \nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107440.html\n MD5 = b918fa5a341815ccdb230560539e8725\n SHA-1 = 38e912a55f1407e18e1bb8305f854fcd97c1adcb\n SHA-256 = c1aaafdd9b23a525236c414e4cf213542246326317070b5e98ac5cccc5fa1e72\n \nvSRX Upgrade TGZ: junos-vsrx-15.1X49-D211-domestic.tgz\nhttps://webdownload.juniper.net/swdl/dl/secure/site/1/record/107452.html\n MD5 = 55b4c96b05b5fd9595a8ee071dbbf438\n SHA-1 = ae6d7978964c3be6b632033b3616208e47653617\n SHA-256 = 20274c3b66d4b54471684a5f534abe0ba1d8bebabbb6f78f0028fcc275076df1"
}
],
"source": {
"advisory": "JSA11021",
"defect": [
"1499280"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "There are no viable workarounds for this issue.\n\nIt is highly recommended to disable HTTP/HTTPS service and DVPN:\n user@device# deactivate system services web-management\n user@device# deactivate security dynamic-vpn (if DVPN is enabled)\n user@device# commit\nor allowing HTTP service only on from trusted hosts or networks (refer to https://kb.juniper.net/KB21265 for details on how to limite HTTP service)."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2020-1631",
"datePublished": "2020-05-04T09:25:12.322Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2025-07-30T01:45:42.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…