SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files
Priority MEDIUM 42CWE-16Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.
Why it matters now
EPSS 0.01158 67th percentileScored 2026-11-07
Fix Fixed SRC Series (Juniper Networks): 4.12.0R5, 4.13.0R3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | SRC Series | before 4.12.0R5; 4.13.0 to before 4.13.0R3 | 4.12.0R5, 4.13.0R3 | Patch available | CNA |
- SRC Series VendorJuniper Affected before 4.12.0R5; 4.13.0 to before 4.13.0R3 Fixed in 4.12.0R5, 4.13.0R3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juniper:session_and_resource_control:*:*:*:*:*:*:*:* | before 4.12.0r5; 4.13.0r1 to before 4.13.0r3 | Vulnerable | Juniper |
- cpe:2.3:a:juniper:session_and_resource_control:*:*:*:*:*:*:*:* Versions before 4.12.0r5; 4.13.0r1 to before 4.13.0r3 Vulnerable ·Juniper
Remediation
- Fix · CNA SRC Series (Juniper Networks) Fixed in 4.12.0R5, 4.13.0R3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Juniper Networks SRC Series 4.12.0R5, 4.13.0R3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-11524 Information disclosure in Juniper SRC SeriesPriority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31381
- 2026-10-03 Alias added: GHSA-7wfg-7xjc-w75v
References
More Juniper Session And Resource Control vulnerabilities
- TI-2008-00921 SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and… CVSS 2.0HIGH 10.0
- TI-2021-11524 Information disclosure in Juniper SRC Series CVSS 3.1MEDIUM 5.3
- TI-2021-11496 SRC Series: NETCONF over SSH allows negotiation of weak ciphers CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-31381 · CVE Program
- CVE-2021-31381 · NVD
- FIRST EPSS
- GHSA-7wfg-7xjc-w75v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences