CVE-2021-31384 Missing authorization in Junos OS

High 7.2 Published 19 Oct 2021 Updated 16 Sep 2024

Attackers can bypass interface restrictions to access J-Web management on Juniper SRX devices under specific configurations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-31384?

CVE-2021-31384 is a high-severity missing authorization vulnerability in Juniper Junos, published on 19 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

Weakness: CWE-939, CWE-862, CWE-551, CWE-285, CWE-1220

Which versions are affected by CVE-2021-31384?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2021-31384?

No fix has been published for CVE-2021-31384 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-31384 being exploited?

There is no known exploitation of CVE-2021-31384 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-g6h6-r377-vh4m.