CVE-2021-31381
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-16, CWE-200
- Affected
- juniper/session and resource control
- Source
- sirt@juniper.net
References
- https://kb.juniper.net/JSA11248Patch, Vendor Advisory
- https://kb.juniper.net/JSA11248Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.