title: Junos Space: Authenticated user able to delete devices without delete device privileges
description: A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
problem types: Improper Access Control
affected:
{
product: Junos Space
vendor: Juniper Networks
versions:
lessThan: 18.3R1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.0
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
workarounds: Use access lists or firewall filters to limit access to the device's management interface only from trusted hosts and administrators.