CVE-2021-31380: SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-19 · updated 2026-06-17
Weakness: CWE-16

Description

A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive information.

Affected products

Juniper Session And Resource Control: before 4.12.0r5; from 4.13.0r1 before 4.13.0r3 — fixed in 4.12.0r5, 4.13.0r3

How to fix

Upgrade to a fixed version: Juniper Session And Resource Control 4.12.0r5, 4.13.0r3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-31380 or the next vulnerability affects your stack