CVE-2021-31381 SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files
Remote attackers can delete files on Juniper SRC Series devices via crafted queries due to a JBoss configuration weakness, impacting system integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-31381?
CVE-2021-31381 is a medium-severity vulnerability in Juniper Networks SRC Series, published on 19 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.
Which versions are affected by CVE-2021-31381?
It affects 1 product.
Products include Juniper Session and Resource Control.
How do I fix CVE-2021-31381?
No fix has been published for CVE-2021-31381 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-31381 being exploited?
There is no known exploitation of CVE-2021-31381 in the wild and no public exploit code.
Other vulnerabilities in Juniper Networks SRC Series
Sources
Also known as GHSA-7wfg-7xjc-w75v.