CVE-2019-0015

Description

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.193

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-0015 are fixed in junos 12.3x48-d75	NCM
Vulnerabilities CVE-2019-0015 are fixed in junos 15.1x49-d150	NCM
Multiple Vulnerabilities are fixed in junos 17.3r3	NCM
Multiple Vulnerabilities are fixed in junos 17.4R2	NCM
Multiple Vulnerabilities are fixed in junos 18.1R3	NCM
Multiple Vulnerabilities are fixed in junos 18.2r2	NCM
Insufficient Session Expiration Vulnerability (CVE-2019-0015)	NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-1704488	Security Update for junos 9.2r1
PATCH-1704488	Security Update for junos 9.2r1
PATCH-1704488	Security Update for junos 9.2r1
PATCH-1704488	Security Update for junos 9.2r1
PATCH-1704488	Security Update for junos 9.2r1
PATCH-1704488	Security Update for junos 9.2r1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234