High severity · published Jan 15, 2019
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 18.3R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0017
Vendor Advisory
https://kb.juniper.net/JSA10917
More from Junos Space
6.5
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges
6.1
CVE-2026-21904
Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection