Medium severity · published Jan 15, 2019
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 18.3R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0016
Vendor Advisory
https://kb.juniper.net/JSA10917
More from Junos Space
9.0
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application
8.8
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
7.5
CVE-2025-59975
Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS
7.3
CVE-2024-39563
Junos Space: Remote Command Execution (RCE) vulnerability in web application
6.5
CVE-2025-59976
Junos Space: Arbitrary file download vulnerability in web interface