CVE-2021-31352
Last modified
CVE-2021-31352 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. EPSS estimates a 0.81% chance of exploitation in the next 30 days.
Description
An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. This issue affects all Juniper Networks SRC Series versions prior to 4.13.0-R6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Session And Resource Control | < 4.130r6 |
References
- https://kb.juniper.net/JSA11217Exploit, Patch, Vendor Advisory
- https://kb.juniper.net/JSA11217Exploit, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-31352?
How severe is CVE-2021-31352?
How do I fix CVE-2021-31352?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-31347An issue was discovered in libezxml.a in ezXML 0.8.6. The fu…6.5
- CVE-2021-31348An issue was discovered in libezxml.a in ezXML 0.8.6. The fu…6.5
- CVE-2021-31349The usage of an internal HTTP header created an authenticati…9.8
- CVE-2021-3135An issue was discovered in the tagDiv Newspaper theme 10.3.9…6.1
- CVE-2021-31350An Improper Privilege Management vulnerability in the gRPC f…8.8
- CVE-2021-31351An Improper Check for Unusual or Exceptional Conditions in p…7.5
- CVE-2021-31353An Improper Handling of Exceptional Conditions vulnerability…7.5
- CVE-2021-31354An Out Of Bounds (OOB) access vulnerability in the handling …8.8
- CVE-2021-31355A persistent cross-site scripting (XSS) vulnerability in the…5.4
- CVE-2021-31356A command injection vulnerability in command processing on J…7.8
- CVE-2021-31357A command injection vulnerability in tcpdump command process…7.8
- CVE-2021-31358A command injection vulnerability in sftp command processing…7.8
Are you affected by CVE-2021-31352?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST