A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information.

When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
* All versions earlier than 20.4R3-S9;
* 21.2 versions earlier than 21.2R3-S7;
* 21.3 versions earlier than 21.3R3-S5;
* 21.4 versions earlier than 21.4R3-S6;
* 22.1 versions earlier than 22.1R3-S5;
* 22.2 versions earlier than 22.2R3-S3;
* 22.3 versions earlier than 22.3R3-S2;
* 22.4 versions earlier than 22.4R3;
* 23.2 versions earlier than 23.2R1-S2, 23.2R2.


Project Subscriptions

Vendors Products
Juniper Subscribe
Ex2200-c Subscribe
Ex2200-vc Subscribe
Ex2300-24mp Subscribe
Ex2300-24p Subscribe
Ex2300-24t Subscribe
Ex2300-48mp Subscribe
Ex2300-48p Subscribe
Ex2300-48t Subscribe
Ex2300-c Subscribe
Ex2300 Multigigabit Subscribe
Ex2300m Subscribe
Ex3300-vc Subscribe
Ex4100-f Subscribe
Ex4100 Multigigabit Subscribe
Ex4200-vc Subscribe
Ex4300-24p Subscribe
Ex4300-24p-s Subscribe
Ex4300-24t Subscribe
Ex4300-24t-s Subscribe
Ex4300-32f Subscribe
Ex4300-32f-dc Subscribe
Ex4300-32f-s Subscribe
Ex4300-48mp Subscribe
Ex4300-48mp-s Subscribe
Ex4300-48p Subscribe
Ex4300-48p-s Subscribe
Ex4300-48t Subscribe
Ex4300-48t-afi Subscribe
Ex4300-48t-dc Subscribe
Ex4300-48t-dc-afi Subscribe
Ex4300-48t-s Subscribe
Ex4300-48tafi Subscribe
Ex4300-48tdc Subscribe
Ex4300-48tdc-afi Subscribe
Ex4300-mp Subscribe
Ex4300-vc Subscribe
Ex4300 Multigigabit Subscribe
Ex4300m Subscribe
Ex4400-24x Subscribe
Ex4400 Multigigabit Subscribe
Ex4500-vc Subscribe
Ex4550-vc Subscribe
Ex4550\/vc Subscribe
Ex4600-vc Subscribe
Ex8200-vc Subscribe
Ex Redundant Power System Subscribe
Srx1400 Subscribe
Srx1500 Subscribe
Srx1600 Subscribe
Srx2300 Subscribe
Srx240h2 Subscribe
Srx240m Subscribe
Srx3400 Subscribe
Srx3600 Subscribe
Srx4000 Subscribe
Srx4100 Subscribe
Srx4200 Subscribe
Srx4300 Subscribe
Srx4600 Subscribe
Srx4700 Subscribe
Srx5000 Subscribe
Srx5400 Subscribe
Srx550 Hm Subscribe
Srx550m Subscribe
Srx5600 Subscribe
Srx5800 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2024-19267 A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information. When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S6; * 22.1 versions earlier than 22.1R3-S5; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.
Fixes

Solution

The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7*, 21.3R3-S5, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases. *Pending Publication


Workaround

Disable J-Web, or limit access to only trusted hosts.

References
History

Tue, 17 Jun 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2025-06-17T21:19:30.229Z

Reserved: 2023-12-27T19:38:25.710Z

Link: CVE-2024-21619

cve-icon Vulnrichment

Updated: 2024-08-01T22:27:35.795Z

cve-icon NVD

Status : Modified

Published: 2024-01-25T23:15:09.467

Modified: 2024-11-21T08:54:44.270

Link: CVE-2024-21619

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses