Juniper Junos J-Web cross site scripting

artículoeditHistoryDiffjsonxmlCTI

Una vulnerabilidad clasificada como problemática fue encontrada en Juniper Junos (Router Operating System). Una función desconocida del componente J-Web es afectada por esta vulnerabilidad. Una actualización elimina esta vulnerabilidad.

Cronología

Usuario

Campo

Commit Conf

Approve Conf

IDComprometidoUsuarioCampoCambioObservacionesModeradoRazónC
106399462020-11-20VulD...cve_cnaJuniper Networks, Inc.nvd.nist.gov2020-11-20aceptado70
106399452020-11-20VulD...cvss2_nvd_aiCnvd.nist.gov2020-11-20aceptado70
106399442020-11-20VulD...cvss2_nvd_iiCnvd.nist.gov2020-11-20aceptado70
106399432020-11-20VulD...cvss2_nvd_ciCnvd.nist.gov2020-11-20aceptado70
106399422020-11-20VulD...cvss2_nvd_auNnvd.nist.gov2020-11-20aceptado70
106399412020-11-20VulD...cvss2_nvd_acHnvd.nist.gov2020-11-20aceptado70
106399402020-11-20VulD...cvss2_nvd_avNnvd.nist.gov2020-11-20aceptado70
106399392020-11-20VulD...confirm_urlhttps://kb.juniper.net/JSA11070cve.mitre.org2020-11-20aceptado70
106399382020-11-20VulD...cve_nvd_summaryInsufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled such as J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP). Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf In order to successfully exploit this vulnerability, the attacker needs to convince the device administrator to take action such as clicking the crafted URL sent via phishing email or convince the administrator to input data in the browser console. This issue affects Juniper Networks Junos OS: 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R2-S5, 18.4R3-S2; 19.1 versions prior to 19.1R2-S2, 19.1R3-S1; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2; 20.1 versions prior to 20.1R1-S2, 20.1R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.cve.mitre.org2020-11-20aceptado70
106399372020-11-20VulD...cve_assigned1572822000cve.mitre.org2020-11-20aceptado70
106399472020-11-19VulD...cvss2_nvd_basescore7.6nist.gov2020-11-19aceptado90
105283842020-10-17VulD...price_0day$5k-$25ksee documentation2020-10-17aceptado90
105283832020-10-17VulD...cvss3_meta_tempscore4.1see documentation2020-10-17aceptado90
105283822020-10-17VulD...cvss3_meta_basescore4.3see documentation2020-10-17aceptado90
105283812020-10-17VulD...cvss3_vuldb_tempscore4.12020-10-17aceptado90
105283802020-10-17VulD...cvss3_vuldb_basescore4.32020-10-17aceptado90
105283792020-10-17VulD...cvss2_vuldb_tempscore4.42020-10-17aceptado90
105283782020-10-17VulD...cvss2_vuldb_basescore5.02020-10-17aceptado90
105283772020-10-17VulD...cvss3_vuldb_eXderived from historical data2020-10-17aceptado80
105283762020-10-17VulD...cvss2_vuldb_rcNDderived from historical data2020-10-17aceptado80

Do you need the next level of professionalism?

Upgrade your account now!