{"id":"CVE-2025-59976","state":"PUBLISHED","title":"Junos Space: Arbitrary file download vulnerability in web interface","description":"An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.","publishedAt":"2025-10-09T15:59:07.997Z","updatedAt":"2025-10-09T19:49:14.069Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/RE:M","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos Space"],"affected":[{"vendor":"Juniper Networks","product":"Junos Space","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.1R3","versionType":"semver"}]}],"references":["https://supportportal.juniper.net/JSA103170"],"weaknesses":["CWE-552"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/59xxx/CVE-2025-59976.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-59976","state":"PUBLISHED","datePublished":"2025-10-09T15:59:07.997Z","dateUpdated":"2025-10-09T19:49:14.069Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2025-09-23T18:19:06.956Z"},"containers":{"cna":{"title":"Junos Space: Arbitrary file download vulnerability in web interface","descriptions":[{"lang":"en","value":"An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3."}],"affected":[{"vendor":"Juniper Networks","product":"Junos Space","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.1R3","versionType":"semver"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA103170","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/RE:M","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","description":"CWE-552 Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2025-10-09T15:59:07.997Z"},"credits":[{"lang":"en","type":"finder","value":"Juniper SIRT would like to acknowledge and thank Arnoldas Radisauskas and Jorge Escabias from NATO Cyber Security Center for responsibly reporting this vulnerability."}],"datePublic":"2025-10-08T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue: Junos Space 24.1R3, and all subsequent releases."}],"value":"The following software releases have been updated to resolve this specific issue: Junos Space 24.1R3, and all subsequent releases."}],"source":{"advisory":"JSA103170","defect":["1809260"],"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Use access lists or firewall filters to limit access to the device only from trusted hosts.<br>"}],"value":"Use access lists or firewall filters to limit access to the device only from trusted hosts."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-09T19:43:28.910167Z","id":"CVE-2025-59976","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-09T19:49:14.069Z"}}]}}}