CVE-2021-0265
Last modified
CVE-2021-0265 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the environment. This issue affects: Juniper Networks AppFormix 3 versions prior to 3.1.22, 3.2.14, 3.3.0.. EPSS estimates a 2.55% chance of exploitation in the next 30 days.
Description
An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the environment. This issue affects: Juniper Networks AppFormix 3 versions prior to 3.1.22, 3.2.14, 3.3.0.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Appformix | >= 3.0.0, < 3.1.22 |
| Juniper | Appformix | >= 3.2.0, < 3.2.14 |
References
- https://kb.juniper.net/JSA11156Vendor Advisory
- https://kb.juniper.net/JSA11156Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-0265?
How severe is CVE-2021-0265?
How do I fix CVE-2021-0265?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-0259Due to a vulnerability in DDoS protection in Juniper Network…7.4
- CVE-2021-0260An improper authorization vulnerability in the Simple Networ…7.3
- CVE-2021-0261A vulnerability in the HTTP/HTTPS service used by J-Web, Web…7.5
- CVE-2021-0262Through routine static code analysis of the Juniper Networks…6.5
- CVE-2021-0263A Data Processing vulnerability in the Multi-Service process…5.9
- CVE-2021-0264A vulnerability in the processing of traffic matching a fire…7.5
- CVE-2021-0266The use of multiple hard-coded cryptographic keys in cSRX Se…9.8
- CVE-2021-0267An Improper Input Validation vulnerability in the active-lea…6.5
- CVE-2021-0268An Improper Neutralization of CRLF Sequences in HTTP Headers…9.3
- CVE-2021-0269The improper handling of client-side parameters in J-Web of …8.8
- CVE-2021-0270On PTX Series and QFX10k Series devices with the "inline-jfl…5.9
- CVE-2021-0271A Double Free vulnerability in the software forwarding inter…6.5
Are you affected by CVE-2021-0265?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST