CVE-2020-1611

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Juniper Networks	Junos Space	>= unspecified, < 19.4R1

References

https://kb.juniper.net/JSA10993Vendor Advisory
https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1449224Permissions Required
https://kb.juniper.net/JSA10993Vendor Advisory
https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1449224Permissions Required

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-161163.3In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory trav CVE-2020-161175.9In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an in CVE-2020-161187.5In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sen CVE-2020-161197.8Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_CVE-2020-161204.4Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user names CVE-2020-161213.3PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that CVE-2020-161227.8PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the co CVE-2020-161234.7An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from CVE-2020-161249.8Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated CVE-2020-161256.8gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely CVE-2020-161263.3An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped t CVE-2020-161275.5An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unboun