CVE-2013-5096 Missing authorization in n/a

What is CVE-2013-5096?

CVE-2013-5096 is a medium-severity missing authorization vulnerability in Juniper Junos Space, published on 16 Aug 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804.

Weakness: CWE-264

Which versions are affected by CVE-2013-5096?

It affects 3 products.

Products include Juniper Junos Space, Juniper Junos Space Ja1500 Appliance, Juniper Junos Space Virtual Appliance.

How do I fix CVE-2013-5096?

No fix has been published for CVE-2013-5096 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-5096 being exploited?

There is no known exploitation of CVE-2013-5096 in the wild and no public exploit code.

Other vulnerabilities in Juniper Junos Space

• CVE-2014-3412 Command injection in n/a Critical 10.0
• CVE-2014-3413 Hardcoded credentials in n/a Critical 9.8
• CVE-2016-1265 Junos Space: privilege escalation vulnerabilities in Junos Space Critical 9.8
• CVE-2017-10622 Junos Space: Authentication bypass vulnerability Critical 9.8
• CVE-2016-4926 Auth bypass in n/a Critical 9.8

All Juniper Junos Space vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-93wq-q2fx-rxh8.