CVE-2019-0062 - Junos OS: Session fixation vulnerability in J-Web

Back Back to CVE browser

HIGH

Junos OS: Session fixation vulnerability in J-Web

Published Oct 9, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.08%

Description

A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S5; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2.

Affected products

Vendor Juniper Networks Product Junos OS Default
n/a
- Version
  12.3
  Status
  affected
  Constraints
  <12.3R12-S15
- Version
  12.3X48
  Status
  affected
  Constraints
  <12.3X48-D85
- Version
  14.1X53
  Status
  affected
  Constraints
  <14.1X53-D51
- Version
  15.1
  Status
  affected
  Constraints
  <15.1F6-S13, 15.1R7-S5
- Version
  15.1X49
  Status
  affected
  Constraints
  <15.1X49-D180
- Version
  15.1X53
  Status
  affected
  Constraints
  <15.1X53-D238
- Version
  16.1
  Status
  affected
  Constraints
  <16.1R4-S13, 16.1R7-S5
- Version
  16.2
  Status
  affected
  Constraints
  <16.2R2-S10
- Version
  17.1
  Status
  affected
  Constraints
  <17.1R3-S1
- Version
  17.2
  Status
  affected
  Constraints
  <17.2R2-S8, 17.2R3-S3
- Version
  17.3
  Status
  affected
  Constraints
  <17.3R3-S5
- Version
  17.4
  Status
  affected
  Constraints
  <17.4R2-S8, 17.4R3
- Version
  18.1
  Status
  affected
  Constraints
  <18.1R3-S8
- Version
  18.2
  Status
  affected
  Constraints
  <18.2R3
- Version
  18.3
  Status
  affected
  Constraints
  <18.3R3
- Version
  18.4
  Status
  affected
  Constraints
  <18.4R2
- Version
  19.1
  Status
  affected
  Constraints
  <19.1R1-S2, 19.1R2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Junos OS

n/a

Version	Status	Constraints
12.3	affected	<12.3R12-S15
12.3X48	affected	<12.3X48-D85
14.1X53	affected	<14.1X53-D51
15.1	affected	<15.1F6-S13, 15.1R7-S5
15.1X49	affected	<15.1X49-D180
15.1X53	affected	<15.1X53-D238
16.1	affected	<16.1R4-S13, 16.1R7-S5
16.2	affected	<16.2R2-S10
17.1	affected	<17.1R3-S1
17.2	affected	<17.2R2-S8, 17.2R3-S3
17.3	affected	<17.3R3-S5
17.4	affected	<17.4R2-S8, 17.4R3
18.1	affected	<18.1R3-S8
18.2	affected	<18.2R3
18.3	affected	<18.3R3
18.4	affected	<18.4R2
19.1	affected	<19.1R1-S2, 19.1R2

Remediation

Vendor solution

The following software releases have been updated to resolve this specific issue: 12.3R12-S15*, 12.3X48-D85, 14.1X53-D51, 15.1F6-S13, 15.1R7-S5, 15.1X49-D180, 15.1X53-D238, 16.1R4-S13, 16.1R7-S5, 16.2R2-S10, 17.1R3-S1, 17.2R2-S8, 17.2R3-S3, 17.3R3-S5, 17.4R2-S8, 17.4R3*, 18.1R3-S8*, 18.2R3, 18.3R3, 18.4R2, 19.1R1-S2, 19.1R2, 19.2R1, and all subsequent releases. *pending publication

Weaknesses (1)

CWE-384

References (1)

https://kb.juniper.net/JSA10961
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://kb.juniper.net/JSA10961		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner juniper

Published Oct 9, 2019

Updated Sep 16, 2024

Reserved Oct 11, 2018

Link CVE-2019-0062

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-0062

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-0062