CVE-2021-31384: Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper…

PriorityP265critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

1.12%

62.6th percentile

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
juniper	j-web	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	srx_series	—	—
juniper_networks	junos_os	>= 20.4R1 < 20.4*	20.4*
juniper_networks	junos_os	>= 21.1 < 21.1R1-S1, 21.1R2	21.1R1-S1, 21.1R2

Detection & IOCsextracted from sources · hover to see the quote

→Attacker attempts to access J-Web administrative interfaces from any device interface, bypassing web-management configuration and filter rules — monitor for J-Web access originating from unexpected or non-management interfaces on SRX Series devices ↗

·Vulnerability is only triggered in a specific device configuration — the Missing Authorization and Insufficient Granularity of Access Control weakness requires a particular configuration state to be exploitable on SRX Series devices ↗
·Affected versions are Junos OS SRX Series 20.4R1 up to (not including) 20.4R2-S1/20.4R3, and 21.1 prior to 21.1R1-S1/21.1R2; versions prior to 20.4R1 are NOT affected ↗

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.