CVE-2021-31380
CVE-2021-31380 is a medium-severity vulnerability in Juniper Session And Resource Control with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-16.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- CVSS v2: 5.0
- EPSS exploit prediction: 1% (62nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-16
- Affected product: Juniper Session And Resource Control
- Published:
- Last modified:
Description
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive information.
Frequently asked questions
- What is CVE-2021-31380?
- A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive information.
- How severe is CVE-2021-31380?
- CVE-2021-31380 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2021-31380 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-31380?
- CVE-2021-31380 affects Juniper Session And Resource Control. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-31380?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-31380 published?
- CVE-2021-31380 was published on 2021-10-19 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:juniper:session_and_resource_control:*:*:*:*:*:*:*:*
More vulnerabilities in Juniper Session And Resource Control
- CVE-2008-0960 — Critical (CVSS 10.0): SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2)…
- CVE-2021-31381 — Medium (CVSS 6.5): A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a…
- CVE-2021-31352 — Medium (CVSS 5.3): An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits…
All CVEs affecting Juniper Session And Resource Control →
Other CWE-16 vulnerabilities
- CVE-2013-4316 — Critical (CVSS 10.0): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack…
- CVE-2013-1221 — Critical (CVSS 10.0): The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not…
- CVE-2011-4501 — Critical (CVSS 10.0): The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg,…
- CVE-2010-4586 — Critical (CVSS 10.0): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and…
- CVE-2010-2977 — Critical (CVSS 10.0): Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has…
- CVE-2010-2276 — Critical (CVSS 10.0): The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2,…