Vulnerability Database

290,301

Total vulnerabilities in the database

CVE-2018-0025

When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.

  • Published: Jul 11, 2018
  • Updated: Apr 13, 2023
  • CVE: CVE-2018-0025
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.1
  • AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Software From Fixed in
juniper / junos 12.1x46-d60 12.1x46-d60.x
juniper / junos 12.1x46-d30 12.1x46-d30.x
juniper / junos 12.1x46-d45 12.1x46-d45.x
juniper / junos 12.1x46-d50 12.1x46-d50.x
juniper / junos 12.1x46-d25 12.1x46-d25.x
juniper / junos 12.1x46 12.1x46.x
juniper / junos 12.1x46-d65 12.1x46-d65.x
juniper / junos 12.1x46-d35 12.1x46-d35.x
juniper / junos 12.1x46-d20 12.1x46-d20.x
juniper / junos 12.1x46-d40 12.1x46-d40.x
juniper / junos 12.1x46-d15 12.1x46-d15.x
juniper / junos 12.1x46-d10 12.1x46-d10.x
juniper / junos 12.1x46-d55 12.1x46-d55.x
juniper / junos 12.1x46-d66 12.1x46-d66.x
juniper / junos 12.3x48-d10 12.3x48-d10.x
juniper / junos 12.3x48-d15 12.3x48-d15.x
juniper / junos 12.3x48 12.3x48.x
juniper / junos 12.3x48-d20 12.3x48-d20.x
juniper / junos 15.1x49-d30 15.1x49-d30.x
juniper / junos 15.1x49 15.1x49.x
juniper / junos 15.1x49-d20 15.1x49-d20.x
juniper / junos 15.1x49-d10 15.1x49-d10.x