CVE-2021-31381: SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-19 · updated 2026-06-17
Weakness: CWE-16

Description

A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.

Affected products

Juniper Session And Resource Control: before 4.12.0r5; from 4.13.0r1 before 4.13.0r3 — fixed in 4.12.0r5, 4.13.0r3

How to fix

Upgrade to a fixed version: Juniper Session And Resource Control 4.12.0r5, 4.13.0r3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-31381 or the next vulnerability affects your stack