{"api_version":"1","generated_at":"2026-07-23T19:00:29+00:00","cve":"CVE-2019-0039","urls":{"html":"https://cve.report/CVE-2019-0039","api":"https://cve.report/api/cve/CVE-2019-0039.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-0039","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0039"},"summary":{"title":"CVE-2019-0039","description":"If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.","state":"PUBLIC","assigner":"sirt@juniper.net","published_at":"2019-04-10 20:29:00","updated_at":"2021-10-25 16:19:00"},"problem_types":["CWE-307"],"metrics":[],"references":[{"url":"https://kb.juniper.net/JSA10928","name":"https://kb.juniper.net/JSA10928","refsource":"CONFIRM","tags":["Mitigation","Vendor Advisory"],"title":"2019-04 Security Bulletin: Junos OS: Login credentials are vulnerable to brute force attacks through the REST API (CVE-2019-0039) - Juniper Networks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/107899","name":"107899","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0039","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0039","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1r7-s3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d495","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d591","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d69","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r4-s12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r6-s6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r7-s3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.1r3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.2r3-s1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.4r2-s2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"18.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"18.1r3-s1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1r7-s3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d495","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d591","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"15.1x53-d69","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r4-s12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r6-s6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"16.1r7-s3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.1r3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.2r3-s1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"17.4r2-s2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"39","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"juniper","cpe5":"junos","cpe6":"18.1r3-s1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"sirt@juniper.net","DATE_PUBLIC":"2019-04-10T16:00:00.000Z","ID":"CVE-2019-0039","STATE":"PUBLIC","TITLE":"Junos OS: Login credentials are vulnerable to brute force attacks through the REST API"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Junos OS","version":{"version_data":[{"version_affected":"<","version_name":"14.1X53","version_value":"14.1X53-D49"},{"version_affected":"<","version_name":"15.1","version_value":"15.1F6-S12, 15.1R7-S3"},{"version_affected":"<","version_name":"15.1X49","version_value":"15.1X49-D160"},{"version_affected":"<","version_name":"15.1X53","version_value":"15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69"},{"version_affected":"<","version_name":"16.1","version_value":"16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3"},{"version_affected":"<","version_name":"16.1X65","version_value":"16.1X65-D49"},{"version_affected":"<","version_name":"16.2","version_value":"16.2R2-S7"},{"version_affected":"<","version_name":"17.1","version_value":"17.1R2-S10, 17.1R3"},{"version_affected":"<","version_name":"17.2","version_value":"17.2R1-S8, 17.2R3-S1"},{"version_affected":"<","version_name":"17.3","version_value":"17.3R3-S2"},{"version_affected":"<","version_name":"17.4","version_value":"17.4R1-S6, 17.4R2-S2"},{"version_affected":"<","version_name":"18.1","version_value":"18.1R2-S4, 18.1R3-S1"},{"version_affected":"<","version_name":"18.2","version_value":"18.2R1-S5"},{"version_affected":"<","version_name":"18.2X75","version_value":"18.2X75-D30"},{"version_affected":"<","version_name":"18.3","version_value":"18.3R1-S1"}]}}]},"vendor_name":"Juniper Networks"}]}},"configuration":[{"lang":"eng","value":"The REST API can be enabled using the following configuration option:\n\n  system services rest http\n  system services rest enable-explorer "}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1."}]},"exploit":[{"lang":"eng","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"generator":{"engine":"Vulnogram 0.0.6"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}]},"references":{"reference_data":[{"name":"https://kb.juniper.net/JSA10928","refsource":"CONFIRM","url":"https://kb.juniper.net/JSA10928"},{"refsource":"BID","name":"107899","url":"http://www.securityfocus.com/bid/107899"}]},"solution":[{"lang":"eng","value":"The following software releases have been updated to resolve this specific issue: Junos OS 14.1X53-D49, 15.1F6-S12, 15.1R7-S3, 15.1X49-D160, 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69, 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3, 16.1X65-D49, 16.2R2-S7, 17.1R2-S10, 17.1R3, 17.2R1-S8, 17.2R3-S1, 17.3R3-S2, 17.4R1-S6, 17.4R2-S2, 18.1R2-S4, 18.1R3-S1, 18.2R1-S5, 18.2X75-D30, 18.3R1-S1, 18.4R1, and all subsequent releases.\n"}],"source":{"advisory":"JSA10928","defect":["1289313"],"discovery":"INTERNAL"},"work_around":[{"lang":"eng","value":"Setting a connection limit on REST API may help mitigate this issue.\n  set system services rest control connection-limit 100 \n\nUse access lists or firewall filters to limit API access to the device only from trusted hosts.\n"}]},"nvd":{"publishedDate":"2019-04-10 20:29:00","lastModifiedDate":"2021-10-25 16:19:00","problem_types":["CWE-307"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:17.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:16.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:18.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"18.2x75","versionEndExcluding":"18.2x75-d30","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"17.3","versionEndExcluding":"17.3r3-s2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:17.2r3-s1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"18.2","versionEndExcluding":"18.2r1-s5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"18.1","versionEndExcluding":"18.1r2-s4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"17.4","versionEndExcluding":"17.4r1-s6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"17.2","versionEndExcluding":"17.2r1-s8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"17.1","versionEndExcluding":"17.1r2-s10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"16.1","versionEndExcluding":"16.1r3-s10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:15.1x53-d495:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:15.1x53-d591:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:15.1x53-d69:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"14.1x53","versionEndExcluding":"14.1x53-d49","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:15.1r7-s3:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.1","versionEndExcluding":"15.1f6-s12","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.1x49","versionEndExcluding":"15.1x49-d160","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.1x53","versionEndExcluding":"15.1x53-d236","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"16.1x65","versionEndExcluding":"16.1x65-d49","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"16.2","versionEndExcluding":"16.2r2-s7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*","versionStartIncluding":"18.3","versionEndExcluding":"18.3r1-s1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"39","Ordinal":"135112","Title":"CVE-2019-0039","CVE":"CVE-2019-0039","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"39","Ordinal":"1","NoteData":"If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"39","Ordinal":"2","NoteData":"2019-04-10","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"39","Ordinal":"3","NoteData":"2019-04-15","Type":"Other","Title":"Modified"}]}}}