CVE-2024-21619

MEDIUM
Published Jan 25, 2024 Modified Nov 21, 2024 CWE-209 CWE-306

Description

A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information. When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S6; * 22.1 versions earlier than 22.1R3-S5; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.

Is your site exposed to CVE-2024-21619?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-209 CWE-209
CWE-306 Missing Authentication

Affected Products

Vendor Product
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper ex_redundant_power_system
juniper ex_rps
juniper ex2200
juniper ex2200-c
juniper ex2200-vc
juniper ex2300
juniper ex2300-24mp
juniper ex2300-24p
juniper ex2300-24t
juniper ex2300-48mp
juniper ex2300-48p
juniper ex2300-48t
juniper ex2300-c
juniper ex2300_multigigabit
juniper ex2300m
juniper ex3200
juniper ex3300
juniper ex3300-vc
juniper ex3400
juniper ex4100
juniper ex4100-f
juniper ex4100_multigigabit
juniper ex4200
juniper ex4200-vc
juniper ex4300
juniper ex4300-24p
juniper ex4300-24p-s
juniper ex4300-24t
juniper ex4300-24t-s
juniper ex4300-32f
juniper ex4300-32f-dc
juniper ex4300-32f-s
juniper ex4300-48mp
juniper ex4300-48mp-s
juniper ex4300-48p
juniper ex4300-48p-s
juniper ex4300-48t
juniper ex4300-48t-afi
juniper ex4300-48t-dc
juniper ex4300-48t-dc-afi
juniper ex4300-48t-s
juniper ex4300-48tafi
juniper ex4300-48tdc
juniper ex4300-48tdc-afi
juniper ex4300-mp
juniper ex4300-vc
juniper ex4300_multigigabit
juniper ex4300m
juniper ex4400
juniper ex4400-24x
juniper ex4400_multigigabit
juniper ex4500
juniper ex4500-vc
juniper ex4550
juniper ex4550-vc
juniper ex4550\/vc
juniper ex4600
juniper ex4600-vc
juniper ex4650
juniper ex6200
juniper ex6210
juniper ex8200
juniper ex8200-vc
juniper ex8208
juniper ex8216
juniper ex9200
juniper ex9204
juniper ex9208
juniper ex9214
juniper ex9250
juniper ex9251
juniper ex9253
juniper srx100
juniper srx110
juniper srx1400
juniper srx1500
juniper srx1600
juniper srx210
juniper srx220
juniper srx2300
juniper srx240
juniper srx240h2
juniper srx240m
juniper srx300
juniper srx320
juniper srx340
juniper srx3400
juniper srx345
juniper srx3600
juniper srx380
juniper srx4000
juniper srx4100
juniper srx4200
juniper srx4300
juniper srx4600
juniper srx4700
juniper srx5000
juniper srx5400
juniper srx550
juniper srx550_hm
juniper srx550m
juniper srx5600
juniper srx5800
juniper srx650

References

Frequently Asked Questions

What is CVE-2024-21619? +
A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information. When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S6; * 22.1 versions earlier than 22.1R3-S5; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2. It has a CVSS v3.1 base score of 5.3 (MEDIUM).
How severe is CVE-2024-21619? +
CVE-2024-21619 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-21619? +
CVE-2024-21619 affects products from juniper, specifically: ex2200, ex2200-c, ex2200-vc, ex2300, ex2300-24mp, ex2300-24p, ex2300-24t, ex2300-48mp, ex2300-48p, ex2300-48t, ex2300-c, ex2300_multigigabit, ex2300m, ex3200, ex3300, ex3300-vc, ex3400, ex4100, ex4100-f, ex4100_multigigabit, ex4200, ex4200-vc, ex4300, ex4300-24p, ex4300-24p-s, ex4300-24t, ex4300-24t-s, ex4300-32f, ex4300-32f-dc, ex4300-32f-s, ex4300-48mp, ex4300-48mp-s, ex4300-48p, ex4300-48p-s, ex4300-48t, ex4300-48t-afi, ex4300-48t-dc, ex4300-48t-dc-afi, ex4300-48t-s, ex4300-48tafi, ex4300-48tdc, ex4300-48tdc-afi, ex4300-mp, ex4300-vc, ex4300_multigigabit, ex4300m, ex4400, ex4400-24x, ex4400_multigigabit, ex4500, ex4500-vc, ex4550, ex4550-vc, ex4550\/vc, ex4600, ex4600-vc, ex4650, ex6200, ex6210, ex8200, ex8200-vc, ex8208, ex8216, ex9200, ex9204, ex9208, ex9214, ex9250, ex9251, ex9253, ex_redundant_power_system, ex_rps, junos, srx100, srx110, srx1400, srx1500, srx1600, srx210, srx220, srx2300, srx240, srx240h2, srx240m, srx300, srx320, srx340, srx3400, srx345, srx3600, srx380, srx4000, srx4100, srx4200, srx4300, srx4600, srx4700, srx5000, srx5400, srx550, srx550_hm, srx550m, srx5600, srx5800, srx650. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-21619? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-3259

A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google …
CVE-2025-40653

User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages …
CVE-2023-40457

The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected …
CVE-2025-9977

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not …
CVE-2025-13596

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When …
CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-21619 — free, no signup required.