CVE-2019-0042: juniper networks juniper identity management service
Vulnerability summary
CVE-2019-0042 is a medium (CVSS 5.7) vulnerability in juniper networks juniper identity management service. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities.
Timeline
- 10-04-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.7MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Affected systems
Juniper1 product
- identity_management_service< 1.1.4
Juniper networks1 product
- juniper identity management service≥ unspecified, < 1.1.4
2 vendors · 2 products