Vulnerability in Juniper Junos Space
CVE-2025-59976
An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 19.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Juniper Junos Space — versions 24.1
- Juniper Networks Junos Space — versions 0
Weakness classification (CWE)
References
- supportportal.juniper.net/JSA103170 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-59976?
- CVE-2025-59976 is a medium-severity vulnerability in Juniper Junos Space, classified under Files or Directories Accessible to External Parties. CVSS score: 6.5/10. Published 2025-10-09.
- How severe is CVE-2025-59976?
- Medium severity. CVSS v3 base score is 6.5 out of 10.