CVE-2019-0015

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-00166.5A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted CVE-2019-00178.8The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of CVE-2019-00185.4A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbit CVE-2019-00197.5When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While CVE-2019-00209.8Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any CVE-2019-00215.5On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local u CVE-2019-00229.8Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any i CVE-2019-00235.4A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary CVE-2019-00245.4A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00255.4A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00265.4A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitr CVE-2019-00275.4A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject