CVE-2019-0015

EPSS 0.81%
Veröffentlicht 15.01.2019 21:29:01
Zuletzt bearbeitet 21.11.2024 04:16:03
Erkennungen
Login

Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 5

NVD 74 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Version 12.3x48 Update -

   Juniper ≫ Srx100 Version -
   Juniper ≫ Srx110 Version -
   Juniper ≫ Srx1400 Version -
   Juniper ≫ Srx1500 Version -
   Juniper ≫ Srx210 Version -
   Juniper ≫ Srx220 Version -
   Juniper ≫ Srx240 Version -
   Juniper ≫ Srx300 Version -
   Juniper ≫ Srx320 Version -
   Juniper ≫ Srx340 Version -
   Juniper ≫ Srx3400 Version -
   Juniper ≫ Srx345 Version -
   Juniper ≫ Srx3600 Version -
   Juniper ≫ Srx380 Version -
   Juniper ≫ Srx4000 Version -
   Juniper ≫ Srx4100 Version -
   Juniper ≫ Srx5400 Version -
   Juniper ≫ Srx550 Version -
   Juniper ≫ Srx5600 Version -
   Juniper ≫ Srx5800 Version -
   Juniper ≫ Srx650 Version -

Juniper ≫ Junos Version 12.3x48 Update d10

Juniper ≫ Junos Version 12.3x48 Update d100

Juniper ≫ Junos Version 12.3x48 Update d15

Juniper ≫ Junos Version 12.3x48 Update d20

Juniper ≫ Junos Version 12.3x48 Update d25

Juniper ≫ Junos Version 12.3x48 Update d30

Juniper ≫ Junos Version 12.3x48 Update d35

Juniper ≫ Junos Version 12.3x48 Update d40

Juniper ≫ Junos Version 12.3x48 Update d45

Juniper ≫ Junos Version 12.3x48 Update d50

Juniper ≫ Junos Version 12.3x48 Update d51

Juniper ≫ Junos Version 12.3x48 Update d55

Juniper ≫ Junos Version 12.3x48 Update d60

Juniper ≫ Junos Version 12.3x48 Update d65

Juniper ≫ Junos Version 12.3x48 Update d66

Juniper ≫ Junos Version 12.3x48 Update d70

Juniper ≫ Junos Version 15.1x49 Update -

Juniper ≫ Junos Version 15.1x49 Update d10

Juniper ≫ Junos Version 15.1x49 Update d100

Juniper ≫ Junos Version 15.1x49 Update d110

Juniper ≫ Junos Version 15.1x49 Update d120

Juniper ≫ Junos Version 15.1x49 Update d130

Juniper ≫ Junos Version 15.1x49 Update d131

Juniper ≫ Junos Version 15.1x49 Update d140

Juniper ≫ Junos Version 15.1x49 Update d15

Juniper ≫ Junos Version 15.1x49 Update d20

Juniper ≫ Junos Version 15.1x49 Update d25

Juniper ≫ Junos Version 15.1x49 Update d30

Juniper ≫ Junos Version 15.1x49 Update d35

Juniper ≫ Junos Version 15.1x49 Update d40

Juniper ≫ Junos Version 15.1x49 Update d45

Juniper ≫ Junos Version 15.1x49 Update d50

Juniper ≫ Junos Version 15.1x49 Update d55

Juniper ≫ Junos Version 15.1x49 Update d60

Juniper ≫ Junos Version 15.1x49 Update d65

Juniper ≫ Junos Version 15.1x49 Update d70

Juniper ≫ Junos Version 15.1x49 Update d75

Juniper ≫ Junos Version 15.1x49 Update d80

Juniper ≫ Junos Version 15.1x49 Update d90

Juniper ≫ Junos Version 17.3 Update -

Juniper ≫ Junos Version 17.3 Update r1

Juniper ≫ Junos Version 17.3 Update r1-s1

Juniper ≫ Junos Version 17.3 Update r1-s4

Juniper ≫ Junos Version 17.3 Update r2

Juniper ≫ Junos Version 17.3 Update r2-s1

Juniper ≫ Junos Version 17.3 Update r2-s2

Juniper ≫ Junos Version 17.3 Update r2-s3

Juniper ≫ Junos Version 17.3 Update r2-s4

Juniper ≫ Junos Version 17.3 Update r2-s5

Juniper ≫ Junos Version 17.4 Update -

Juniper ≫ Junos Version 17.4 Update r1

Juniper ≫ Junos Version 17.4 Update r1-s1

Juniper ≫ Junos Version 17.4 Update r1-s2

Juniper ≫ Junos Version 17.4 Update r1-s3

Juniper ≫ Junos Version 17.4 Update r1-s4

Juniper ≫ Junos Version 17.4 Update r1-s5

Juniper ≫ Junos Version 17.4 Update r1-s6

Juniper ≫ Junos Version 17.4 Update r1-s7

Juniper ≫ Junos Version 18.1 Update -

Juniper ≫ Junos Version 18.1 Update r

Juniper ≫ Junos Version 18.1 Update r1

Juniper ≫ Junos Version 18.1 Update r2

Juniper ≫ Junos Version 18.1 Update r2-s1

Juniper ≫ Junos Version 18.1 Update r2-s2

Juniper ≫ Junos Version 18.1 Update r2-s4

Juniper ≫ Junos Version 18.2 Update -

Juniper ≫ Junos Version 18.2 Update r

Juniper ≫ Junos Version 18.2 Update r1

Juniper ≫ Junos Version 18.2 Update r1 Edition -

Juniper ≫ Junos Version 18.2 Update r1-s2

Juniper ≫ Junos Version 18.2 Update r1-s3

Juniper ≫ Junos Version 18.2 Update r1-s4

Juniper ≫ Junos Version 18.2 Update r1-s5

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.81%	0.521

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NIST	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:P/A:N
Juniper	5.4	2.8	2.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

http://www.securityfocus.com/bid/106668

Third Party Advisory

VDB Entry

https://kb.juniper.net/JSA10915

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0015

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0015

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0015

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-0015