High severity · published Jan 15, 2019
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 18.3R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0017
Vendor Advisory
https://kb.juniper.net/JSA10917
More from Junos Space
9.0
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application
7.5
CVE-2025-59975
Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS
7.3
CVE-2024-39563
Junos Space: Remote Command Execution (RCE) vulnerability in web application
6.5
CVE-2025-59976
Junos Space: Arbitrary file download vulnerability in web interface
6.5
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges