CVE-2021-0231

Junos OS: SRX, vSRX Series: J-Web Path traversal vulnerability in SRX and vSRX Series leads to information disclosure.

MEDIUM

6.5

CVSS Score

Published: April 22, 2021 at 07:36 PM UTC

Updated: June 17, 2026 at 03:29 AM UTC

15 products affected across 2 vendorsJunosSRX5800SRX5600

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 1%

Description

A path traversal vulnerability in the Juniper Networks SRX and vSRX Series may allow an authenticated J-web user to read sensitive system files. This issue affects Juniper Networks Junos OS on SRX and vSRX Series: 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R2-S4, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R1-S3, 20.2R2; This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

19.3 ≤ v < 19.3R2-S6, 19.3R3-S119.4 ≤ v < 19.4R2-S4, 19.4R320.1 ≤ v < 20.1R1-S4, 20.1R220.2 ≤ v < 20.2R1-S3, 20.2R219.3 19.3 r1 19.3 r1-s1 19.3 r2 19.3 r2-s1 19.3 r2-s2 19.3 r2-s3 19.3 r2-s4 19.3 r2-s5 19.3 r3 19.4 19.4 r1 19.4 r1-s1 19.4 r1-s2 19.4 r2 19.4 r2-s1 19.4 r2-s2 19.4 r2-s3 20.1 20.1 r1 20.1 r1-s1 20.1 r1-s2 20.1 r1-s3 20.2 20.2 r1 20.2 r1-s1 20.2 r1-s2

Vendor states this is fixed in 19.3R1 (unaffected)

Affected range stops below 19.3R2-S6, 19.3R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4R2-S4, 19.4R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.1R1-S4, 20.1R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.2R1-S3, 20.2R2, so it looks safe — our inference, not a vendor statement

juniper-srx1500 (environment) · juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx345 (environment) · juniper-srx380 (environment) · juniper-srx4100 (environment) · juniper-srx4200 (environment) · juniper-srx4600 (environment) · juniper-srx5400 (environment) · juniper-srx550 (environment) · juniper-srx5600 (environment) · juniper-srx5800 (environment) · juniper-vsrx (environment)

Srx1500 · Juniperdevice

80%

All versions

Srx300 · Juniperdevice

80%

All versions

Srx320 · Juniperdevice

80%

All versions

Srx340 · Juniperdevice

80%

All versions