Medium severity · published Jan 15, 2019
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 18.3R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0016
Vendor Advisory
https://kb.juniper.net/JSA10917
More from Junos Space
8.8
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
6.1
CVE-2026-21904
Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection