Read the docs
TI-2021-11524 Aliases CVE-2021-31380GHSA-6cv6-4x62-cqvr

Information disclosure in Juniper SRC Series

Priority LOW 26CWE-16Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive information.

Why it matters now

EPSS 0.01137 66th percentileScored 2026-11-07
Fix Fixed SRC Series (Juniper Networks): 4.12.0R5, 4.13.0R3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperSRC Seriesbefore 4.12.0R5; 4.13.0 to before 4.13.0R34.12.0R5, 4.13.0R3Patch availableCNA
  • SRC Series VendorJuniper Affected before 4.12.0R5; 4.13.0 to before 4.13.0R3 Fixed in 4.12.0R5, 4.13.0R3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:juniper:session_and_resource_control:*:*:*:*:*:*:*:*before 4.12.0r5; 4.13.0r1 to before 4.13.0r3VulnerableJuniper
  • cpe:2.3:a:juniper:session_and_resource_control:*:*:*:*:*:*:*:* Versions before 4.12.0r5; 4.13.0r1 to before 4.13.0r3 Vulnerable ·Juniper

Remediation

  • Fix · CNA SRC Series (Juniper Networks) Fixed in 4.12.0R5, 4.13.0R3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Juniper Networks SRC Series 4.12.0R5, 4.13.0R3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-11525 SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete filesPriority MEDIUM 42
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31380
  2. 2026-10-03 Alias added: GHSA-6cv6-4x62-cqvr

References

Patch 1

  • TI-2008-00921 SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and… CVSS 2.0HIGH 10.0
  • TI-2021-11525 SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files CVSS 3.1CRITICAL 9.1
  • TI-2021-11496 SRC Series: NETCONF over SSH allows negotiation of weak ciphers CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences