← Vulnerability feed

Vulnerability record · CVE-2020-1631 · published 4 May 2020

CVE-2020-1631: Juniper Junos OS J-Web HTTP service path traversal and local file inclusion

Juniper · Junos

The HTTP/HTTPS service behind J-Web, Web Authentication, Dynamic-VPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP in Junos OS does not properly handle path input, allowing an unauthenticated attacker to perform local file inclusion or path traversal. Depending on configuration, this lets an attacker read world-readable files, inject commands into httpd.log, or obtain J-Web session tokens, and on Junos OS 19.3R1 and above read the configuration file. Devices with HTTP/HTTPS services disabled are not affected.

9.8 CVSS 3.1 Critical CISA KEV since 25 Mar 2022 EPSS 4.8% · top 8.3% CWE-22 · Path traversalCWE-73 · CWE-73
9.8CVSS 3.1 base score, v2 6.8
4.8%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns "=*;*&" or "*%3b*&" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match "=*;*&|=*%3b*&" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match "=*;*&|=*%3b*&" user@device> show log httpd.log.1.gz | match "=*;*&|=*%3b*&" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCISA KEV listing, confirmed in-the-wild exploitation, and a CVSS 9.8 vector with unauthenticated network reachability make this a top remediation priority despite the moderate EPSS score.

What it is

The HTTP/HTTPS service behind J-Web, Web Authentication, Dynamic-VPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP in Junos OS does not properly handle path input, allowing an unauthenticated attacker to perform local file inclusion or path traversal. Depending on configuration, this lets an attacker read world-readable files, inject commands into httpd.log, or obtain J-Web session tokens, and on Junos OS 19.3R1 and above read the configuration file. Devices with HTTP/HTTPS services disabled are not affected.

Impact

An attacker can read files accessible to the httpd user, including the device configuration on 19.3R1 and above, and can steal J-Web session tokens. If an administrator is logged into J-Web, the attacker can inherit that session and gain administrator-level access to J-Web.

Attack surface

Reached over the network through the exposed HTTP/HTTPS service; no authentication is required, and the highest-severity case requires user interaction because the attacker must ride an active J-Web session. Only Junos OS devices with HTTP/HTTPS services enabled are exposed.

Exploitation

Juniper SIRT reported a single instance of exploitation in the wild, and CISA added this CVE to the KEV catalog with a 2022-04-15 remediation due date. EPSS 30-day probability is 0.047 (91st percentile), and no ransomware campaign use is documented.

What to do

  • Upgrade to a fixed Junos OS release for your branch as listed in Juniper advisory JSA11021; patch first.
  • If HTTP/HTTPS services are not needed, disable them, which removes exposure entirely.
  • Restrict management access to the HTTP/HTTPS service to trusted administrative networks and addresses.
  • Avoid leaving J-Web sessions idle; log out when not in use to reduce session-token theft risk.
  • Monitor Juniper advisories for updated fixed releases covering your branch.

Detection

  • Search /var/log/httpd.log and rotated logs for the patterns "=*;*&" or "*%3b*&" using: show log httpd.log | match "=*;*&|=*%3b*&" and repeat for httpd.log.0.gz and httpd.log.1.gz.
  • Alert on unexpected outbound connections or file reads by the httpd process running as user 'nobody'.
  • Review J-Web session activity for logins or actions not tied to a known administrator session.
  • Confirm HTTP/HTTPS services are disabled where not required by checking for httpd processes with: show system processes | match http.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2020-1631 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Juniper Junos OS Path Traversal Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.juniper.net/JSA11021 MitigationVendor Advisory
https://kb.juniper.net/JSA11021 MitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1631 US Government Resource

Track CVE-2020-1631 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-36845Juniper Junos OS J-Web PHP variable modification RCEJ-Web in Junos OS on EX Series and SRX Series mishandles the PHP PHPRC environment variable, letting a crafted request alter the PHP execution enviro…KEVEPSS 95%analysed6.7CVE-2025-21590Juniper Junos OS kernel improper isolation allows local code injectionJunos OS contains an improper isolation or compartmentalization flaw in the kernel that lets a local attacker with shell access inject arbitrary code…KEVEPSS 1.7%analysed5.3CVE-2023-36851Juniper Junos OS SRX J-Web missing authentication allows file upload/downloadJunos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J…KEVEPSS 1.1%analysed5.3CVE-2023-36844Juniper Junos OS EX Series J-Web PHP Environment Variable ModificationJ-Web on Junos OS for EX Series fails to properly restrict external PHP variable modification, letting an unauthenticated network attacker alter impo…KEVEPSS 90%analysed5.3CVE-2023-36846Juniper Junos OS SRX J-Web Missing Authentication Allows File UploadJunos OS on SRX Series fails to require authentication for a critical function in user.php reachable through J-Web, letting an unauthenticated networ…KEVEPSS 93%analysed5.3CVE-2023-36847Juniper Junos OS EX Series J-Web installAppPackage.php missing authenticationJunos OS on EX Series exposes installAppPackage.php through J-Web without requiring authentication. An unauthenticated network attacker can upload ar…KEVEPSS 83%analysed10.0CVE-2021-31384Juniper junos improper authorization vulnerabilityDue to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in …EPSS 1.2%10.0CVE-2021-0248Juniper junos hard-coded credentials vulnerabilityThis issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an …EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2020-1631), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.