CVE-2019-0039
published 2019-04-10CVE-2019-0039: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an…
PriorityP344high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
1.29%
67.1th percentile
If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | >= 14.1x53 < 14.1x53-d49 | 14.1x53-d49 |
| juniper | junos | >= 15.1 < 15.1f6-s12 | 15.1f6-s12 |
| juniper | junos | >= 15.1x49 < 15.1x49-d160 | 15.1x49-d160 |
| juniper | junos | >= 15.1x53 < 15.1x53-d236 | 15.1x53-d236 |
| juniper | junos | >= 16.1 < 16.1r3-s10 | 16.1r3-s10 |
| juniper | junos | >= 16.1x65 < 16.1x65-d49 | 16.1x65-d49 |
| juniper | junos | >= 16.2 < 16.2r2-s7 | 16.2r2-s7 |
| juniper | junos | >= 17.1 < 17.1r2-s10 | 17.1r2-s10 |
| juniper | junos | >= 17.2 < 17.2r1-s8 | 17.2r1-s8 |
| juniper | junos | >= 17.3 < 17.3r3-s2 | 17.3r3-s2 |
| juniper | junos | >= 17.4 < 17.4r1-s6 | 17.4r1-s6 |
| juniper | junos | >= 18.1 < 18.1r2-s4 | 18.1r2-s4 |
| juniper | junos | >= 18.2 < 18.2r1-s5 | 18.2r1-s5 |
| juniper | junos | >= 18.2x75 < 18.2x75-d30 | 18.2x75-d30 |
| juniper | junos | >= 18.3 < 18.3r1-s1 | 18.3r1-s1 |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 14.1X53 < 14.1X53-D49 | 14.1X53-D49 |
| juniper_networks | junos_os | >= 15.1 < 15.1F6-S12, 15.1R7-S3 | 15.1F6-S12, 15.1R7-S3 |
| juniper_networks | junos_os | >= 15.1X49 < 15.1X49-D160 | 15.1X49-D160 |
| juniper_networks | junos_os | >= 15.1X53 < 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69 | 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69 |
| juniper_networks | junos_os | >= 16.1 < 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3 | 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3 |
| juniper_networks | junos_os | >= 16.1X65 < 16.1X65-D49 | 16.1X65-D49 |
| juniper_networks | junos_os | >= 16.2 < 16.2R2-S7 | 16.2R2-S7 |
| juniper_networks | junos_os | >= 17.1 < 17.1R2-S10, 17.1R3 | 17.1R2-S10, 17.1R3 |
| juniper_networks | junos_os | >= 17.2 < 17.2R1-S8, 17.2R3-S1 | 17.2R1-S8, 17.2R3-S1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2019-0039: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may al
vendor_juniper·2019-04-10·CVSS 8.1
CVE-2019-0039 [HIGH] CWE-307 CVE-2019-0039: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may al
CVE-2019-0039: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to
GHSA
GHSA-6q78-gprw-j4gg: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks
ghsa_unreviewed·2022-05-13
CVE-2019-0039 [HIGH] CWE-307 GHSA-6q78-gprw-j4gg: If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks
If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-04-10
Published