ScreenOS: XSS vulnerability in ScreenOS Firewall (Juniper Networks ScreenOS)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.19 % · percentile 68 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Modified
Description
A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | juniper |
| CVSS 3.0 | CRITICAL 9.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.0 | MEDIUM 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2017-11519
- GCVE · GCVE-0-2017-2336
CERT-FR advisories
- CERTFR-2017-AVI-212 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:juniper:screenos:6.3.0:*:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r1:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r10:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r11:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r13:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r2:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r21:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r22:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r23:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r23b:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r3:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r4:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r5:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r6:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r7:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r8:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r9:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · ScreenOS | affected 6.3.0 prior to 6.3.0r24 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |