CVE-2020-1631: J-Web and Web-based (HTTP/HTTPS) Services Vulnerability Alert
Recently, Juniper officially released a security bulletin to fix vulnerabilities in J-Web and Web-based (HTTP/HTTPS) services in Juniper Networks Junos OS (CVE-2020-1631). “A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal.” An attacker can use this vulnerability to inject commands into the httpd.log file, read the file, or obtain a J-Web session token.
The Junos operating system (Junos OS) used in Juniper Networks high-performance network devices creates a responsive and trusted environment for accelerating the deployment of services and applications over a single network.
Affected version:
- Junos OS 12.3
- Junos OS 12.3X48
- Junos OS 14.1X53
- Junos OS 15.1
- Junos OS 15.1X49
- Junos OS 17.2
- Junos OS 17.3
- Junos OS 17.4
- Junos OS 18.1
- Junos OS 18.2
- Junos OS 18.3
- Junos OS 18.4
- Junos OS 19.1
- Junos OS 19.2
- Junos OS 19.3
- Junos OS 19.4
- Junos OS 20.1
Unaffected version:
- Junos OS 12.3X48-D101
- Junos OS 12.3X48-D105
- Junos OS 15.1X49-D211
- Junos OS 15.1X49-D220
- Junos OS 15.1R7-S7
- Junos OS 16.1R7-S8
- Junos OS 17.2R3-S4
- Junos OS 17.4R2-S11
- Junos OS 17.3R3-S8
- Junos OS 17.4R3-S2
- Junos OS 18.1R3-S10
- Junos OS 18.2R2-S7
- Junos OS 18.2R3-S4
- Junos OS 18.3R2-S4
- Junos OS 18.3R3-S2
- Junos OS 18.4R1-S7
- Junos OS 18.4R3-S2
- Junos OS 19.1R1-S5
- Junos OS 19.1R3-S1
- Junos OS 19.2R2
- Junos OS 19.3R2-S3
- Junos OS 19.3R3
- Junos OS 19.4R1-S2
- Junos OS 19.4R2
- Junos OS 20.1R1-S1
- Junos OS 20.1R2 and all subsequent releases
