ScreenOS: XSS vulnerability in ScreenOS Firewall (Juniper Networks ScreenOS)
En bref
- Source
- NVD
- EPSS
- EPSS 1.08 % · centile 65 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- juniper
- Statut NVD
- Modified
Rechercher sur…
Description
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | juniper |
| CVSS 3.0 | HIGH 8.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.0 | MEDIUM 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-11518
- GCVE · GCVE-0-2017-2335
Avis du CERT-FR
- CERTFR-2017-AVI-212 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:juniper:screenos:6.3.0:*:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r1:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r10:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r11:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r13:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r2:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r21:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r22:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r23:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r23b:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r3:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r4:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r5:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r6:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r7:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r8:*:*:*:*:*:*cpe:2.3:o:juniper:screenos:6.3.0:r9:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Juniper Networks · ScreenOS | affected 6.3.0 prior to 6.3.0r24 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |