CVE-2019-0016— Junos Space: Authenticated user able to delete devices without delete device privileges
Quick assessment
Affected
Juniper Networks Junos Space
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juniper Junos Space是美国瞻博网络（Juniper Networks）公司的一套网络管理解决方案。该方案支持在设备和服务的整个生命周期内对其进行自动配置、监控和故障排除。 Juniper Junos Space 18.3R1中存在安全漏洞。攻击者可利用该漏洞从Junos Space数据库中删除设备。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-0016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos Space: Authenticated user able to delete devices without delete device privileges
Source: CVE Program / CVE List V5
Vulnerability Description
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Juniper Junos Space 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Junos Space是美国瞻博网络（Juniper Networks）公司的一套网络管理解决方案。该方案支持在设备和服务的整个生命周期内对其进行自动配置、监控和故障排除。 Juniper Junos Space 18.3R1中存在安全漏洞。攻击者可利用该漏洞从Junos Space数据库中删除设备。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos Space | unspecified ~ 18.3R1 | - |
|
II. Public POCs for CVE-2019-0016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-0016
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-0016 (1)
-
https://kb.juniper.net/JSA10917 x_refsource_CONFIRM
Same Patch Batch · Juniper Networks · 2019-01-15 · 26 CVEs total
| CVE-2019-0015 | Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections u | |
| CVE-2019-0030 | Juniper ATP: Password hashing uses DES and a hardcoded salt | |
| CVE-2019-0029 | Juniper ATP: Splunk credentials are in logged in clear text | |
| CVE-2019-0027 | Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configuration | |
| CVE-2019-0026 | Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration | |
| CVE-2019-0025 | Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu | |
| CVE-2019-0024 | Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menu | |
| CVE-2019-0023 | Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu | |
| CVE-2019-0022 | Juniper ATP: Two hard coded credentials sharing the same password give an attacker the abi | |
| CVE-2019-0021 | Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text | |
| CVE-2019-0020 | Juniper ATP: Hard coded credentials used in Web Collector | |
| CVE-2019-0018 | Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu | |
| CVE-2019-0017 | Junos Space: Unrestricted file upload vulnerability | |
| CVE-2019-0001 | Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber managem | |
| CVE-2019-0014 | Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packe | |
| CVE-2019-0013 | Junos OS: RPD crash upon receipt of malformed PIM packet | |
| CVE-2019-0012 | Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message | |
| CVE-2019-0011 | Junos OS: Kernel crash after processing specific incoming packet to the out of band manage | |
| CVE-2019-0010 | Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to | |
| CVE-2019-0009 | Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication betwee |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Junos Space
-
CVE-2026-21904
Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to -
CVE-2026-21907
Junos Space: TLS/SSL server supports use of static key ciphe -
CVE-2025-60009
Junos Space: CLI Configlet page is vulnerable to reflected c -
CVE-2025-60002
Junos Space: Template Definitions page is vulnerable to refl -
CVE-2025-60001
Junos Space: Create Quick Template page is vulnerable to ref
Same vendor: Juniper Networks
-
CVE-2026-57054
Junos OS: MX Series: Web filtering doesn't block specificall -
CVE-2026-57032
Junos OS: EX Series: Subscribing to an unsupported telemetry -
CVE-2026-57031
Junos OS: MX Series: For subscribers configured on static in -
CVE-2026-57030
Junos OS: SRX Series: Flow sessions are not getting cleared -
CVE-2026-57029
Junos OS Evolved: QFX Series: When sFlow collector reachabil
V. Comments for CVE-2019-0016
No comments yet