CVE-2020-1611

Junos Space: Malicious HTTP packets sent to Junos Space allow an attacker to view all files on the device.

Description

A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.

Remediation

Solution:

The following software releases have been updated to resolve this specific issue: Junos Space 19.4R1, and all subsequent releases.

Workaround:

There are no known workarounds for this issue. To reduce the risk of exploitation of these issues, use access lists or firewall filters to limit access to Junos Space to only trusted administrative networks, hosts and users.

6.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 5.44% Top 15%

Vendor Advisory juniper.net

Affected: Juniper Networks Junos Space

References

Link	Tags
https://kb.juniper.net/JSA10993	vendor advisory
https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1449224	permissions required

Frequently Asked Questions

What is the severity of CVE-2020-1611?: CVE-2020-1611 has been scored as a medium severity vulnerability.
How to fix CVE-2020-1611?: To fix CVE-2020-1611: The following software releases have been updated to resolve this specific issue: Junos Space 19.4R1, and all subsequent releases.
Is CVE-2020-1611 being actively exploited in the wild?: It is possible that CVE-2020-1611 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~5% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-1611?: CVE-2020-1611 affects Juniper Networks Junos Space.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.