Juniper Junos J-Web cross site scripting

voceeditHistoryDiffjsonxmlCTI

Un punto critico di livello problematico è stato rilevato in Juniper Junos (Router Operating System). Interessato da questa vulnerabilità è una funzione sconosciuta del componente J-Web. L'aggiornamento elimina questa vulnerabilità.

Sequenza temporale

Utente

Campo

Commit Conf

Approve Conf

IDImpegnatoUtenteCampoModificareOsservazioniModeratoMotivoC
1063994620/11/2020VulD...cve_cnaJuniper Networks, Inc.nvd.nist.gov20/11/2020accettato70
1063994520/11/2020VulD...cvss2_nvd_aiCnvd.nist.gov20/11/2020accettato70
1063994420/11/2020VulD...cvss2_nvd_iiCnvd.nist.gov20/11/2020accettato70
1063994320/11/2020VulD...cvss2_nvd_ciCnvd.nist.gov20/11/2020accettato70
1063994220/11/2020VulD...cvss2_nvd_auNnvd.nist.gov20/11/2020accettato70
1063994120/11/2020VulD...cvss2_nvd_acHnvd.nist.gov20/11/2020accettato70
1063994020/11/2020VulD...cvss2_nvd_avNnvd.nist.gov20/11/2020accettato70
1063993920/11/2020VulD...confirm_urlhttps://kb.juniper.net/JSA11070cve.mitre.org20/11/2020accettato70
1063993820/11/2020VulD...cve_nvd_summaryInsufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled such as J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP). Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf In order to successfully exploit this vulnerability, the attacker needs to convince the device administrator to take action such as clicking the crafted URL sent via phishing email or convince the administrator to input data in the browser console. This issue affects Juniper Networks Junos OS: 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R2-S5, 18.4R3-S2; 19.1 versions prior to 19.1R2-S2, 19.1R3-S1; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2; 20.1 versions prior to 20.1R1-S2, 20.1R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.cve.mitre.org20/11/2020accettato70
1063993720/11/2020VulD...cve_assigned1572822000cve.mitre.org20/11/2020accettato70
1063994719/11/2020VulD...cvss2_nvd_basescore7.6nist.gov19/11/2020accettato90
1052838417/10/2020VulD...price_0day$5k-$25ksee documentation17/10/2020accettato90
1052838317/10/2020VulD...cvss3_meta_tempscore4.1see documentation17/10/2020accettato90
1052838217/10/2020VulD...cvss3_meta_basescore4.3see documentation17/10/2020accettato90
1052838117/10/2020VulD...cvss3_vuldb_tempscore4.117/10/2020accettato90
1052838017/10/2020VulD...cvss3_vuldb_basescore4.317/10/2020accettato90
1052837917/10/2020VulD...cvss2_vuldb_tempscore4.417/10/2020accettato90
1052837817/10/2020VulD...cvss2_vuldb_basescore5.017/10/2020accettato90
1052837717/10/2020VulD...cvss3_vuldb_eXderived from historical data17/10/2020accettato80
1052837617/10/2020VulD...cvss2_vuldb_rcNDderived from historical data17/10/2020accettato80

Do you know our Splunk app?

Download it now for free!