When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.
Published 2018-07-11 18:29:00
Updated 2019-10-09 23:31:01
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-0025

0.74%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-0025

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.3
MEDIUM AV:N/AC:M/Au:N/C:P/I:N/A:N
8.6
2.9
NIST
8.1
HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2.2
5.9
NIST
6.1
MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
1.6
4.0
Juniper Networks, Inc.

CWE ids for CVE-2018-0025

  • The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
    Assigned by: sirt@juniper.net (Secondary)
  • The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
    Assigned by: sirt@juniper.net (Secondary)

References for CVE-2018-0025

Products affected by CVE-2018-0025

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!