CVE-2019-0015

EPSS 0.19%
Published 15.01.2019 21:29:01
Last modified 21.11.2024 04:16:03
Source sirt@juniper.net
Teams watchlist Login
Open Login

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

Affected products Warnungen 0 Metrics 4 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Juniper ≫ Junos Version12.3x48 Update-

   Juniper ≫ Srx100 Version-
   Juniper ≫ Srx110 Version-
   Juniper ≫ Srx1400 Version-
   Juniper ≫ Srx1500 Version-
   Juniper ≫ Srx210 Version-
   Juniper ≫ Srx220 Version-
   Juniper ≫ Srx240 Version-
   Juniper ≫ Srx300 Version-
   Juniper ≫ Srx320 Version-
   Juniper ≫ Srx340 Version-
   Juniper ≫ Srx3400 Version-
   Juniper ≫ Srx345 Version-
   Juniper ≫ Srx3600 Version-
   Juniper ≫ Srx380 Version-
   Juniper ≫ Srx4000 Version-
   Juniper ≫ Srx4100 Version-
   Juniper ≫ Srx5400 Version-
   Juniper ≫ Srx550 Version-
   Juniper ≫ Srx5600 Version-
   Juniper ≫ Srx5800 Version-
   Juniper ≫ Srx650 Version-

Juniper ≫ Junos Version12.3x48 Updated10

Juniper ≫ Junos Version12.3x48 Updated100

Juniper ≫ Junos Version12.3x48 Updated15

Juniper ≫ Junos Version12.3x48 Updated20

Juniper ≫ Junos Version12.3x48 Updated25

Juniper ≫ Junos Version12.3x48 Updated30

Juniper ≫ Junos Version12.3x48 Updated35

Juniper ≫ Junos Version12.3x48 Updated40

Juniper ≫ Junos Version12.3x48 Updated45

Juniper ≫ Junos Version12.3x48 Updated50

Juniper ≫ Junos Version12.3x48 Updated51

Juniper ≫ Junos Version12.3x48 Updated55

Juniper ≫ Junos Version12.3x48 Updated60

Juniper ≫ Junos Version12.3x48 Updated65

Juniper ≫ Junos Version12.3x48 Updated66

Juniper ≫ Junos Version12.3x48 Updated70

Juniper ≫ Junos Version15.1x49 Update-

Juniper ≫ Junos Version15.1x49 Updated10

Juniper ≫ Junos Version15.1x49 Updated100

Juniper ≫ Junos Version15.1x49 Updated110

Juniper ≫ Junos Version15.1x49 Updated120

Juniper ≫ Junos Version15.1x49 Updated130

Juniper ≫ Junos Version15.1x49 Updated131

Juniper ≫ Junos Version15.1x49 Updated140

Juniper ≫ Junos Version15.1x49 Updated15

Juniper ≫ Junos Version15.1x49 Updated20

Juniper ≫ Junos Version15.1x49 Updated25

Juniper ≫ Junos Version15.1x49 Updated30

Juniper ≫ Junos Version15.1x49 Updated35

Juniper ≫ Junos Version15.1x49 Updated40

Juniper ≫ Junos Version15.1x49 Updated45

Juniper ≫ Junos Version15.1x49 Updated50

Juniper ≫ Junos Version15.1x49 Updated55

Juniper ≫ Junos Version15.1x49 Updated60

Juniper ≫ Junos Version15.1x49 Updated65

Juniper ≫ Junos Version15.1x49 Updated70

Juniper ≫ Junos Version15.1x49 Updated75

Juniper ≫ Junos Version15.1x49 Updated80

Juniper ≫ Junos Version15.1x49 Updated90

Juniper ≫ Junos Version17.3 Update-

Juniper ≫ Junos Version17.3 Updater1

Juniper ≫ Junos Version17.3 Updater1-s1

Juniper ≫ Junos Version17.3 Updater1-s4

Juniper ≫ Junos Version17.3 Updater2

Juniper ≫ Junos Version17.3 Updater2-s1

Juniper ≫ Junos Version17.3 Updater2-s2

Juniper ≫ Junos Version17.3 Updater2-s3

Juniper ≫ Junos Version17.3 Updater2-s4

Juniper ≫ Junos Version17.3 Updater2-s5

Juniper ≫ Junos Version17.4 Update-

Juniper ≫ Junos Version17.4 Updater1

Juniper ≫ Junos Version17.4 Updater1-s1

Juniper ≫ Junos Version17.4 Updater1-s2

Juniper ≫ Junos Version17.4 Updater1-s3

Juniper ≫ Junos Version17.4 Updater1-s4

Juniper ≫ Junos Version17.4 Updater1-s5

Juniper ≫ Junos Version17.4 Updater1-s6

Juniper ≫ Junos Version17.4 Updater1-s7

Juniper ≫ Junos Version18.1 Update-

Juniper ≫ Junos Version18.1 Updater

Juniper ≫ Junos Version18.1 Updater1

Juniper ≫ Junos Version18.1 Updater2

Juniper ≫ Junos Version18.1 Updater2-s1

Juniper ≫ Junos Version18.1 Updater2-s2

Juniper ≫ Junos Version18.1 Updater2-s4

Juniper ≫ Junos Version18.2 Update-

Juniper ≫ Junos Version18.2 Updater

Juniper ≫ Junos Version18.2 Updater1

Juniper ≫ Junos Version18.2 Updater1 Edition-

Juniper ≫ Junos Version18.2 Updater1-s2

Juniper ≫ Junos Version18.2 Updater1-s3

Juniper ≫ Junos Version18.2 Updater1-s4

Juniper ≫ Junos Version18.2 Updater1-s5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.19%	0.382

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvd@nist.gov	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:P/A:N
sirt@juniper.net	5.4	2.8	2.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

http://www.securityfocus.com/bid/106668

Third Party Advisory

VDB Entry

https://kb.juniper.net/JSA10915

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0015

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0015

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0015

EUVD