CVE-2009-3486

Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to (1) the pinghost program, reachable through the diagnose program; or (2) the traceroute program, reachable through the diagnose program; or (3) the probe-limit parameter to the configuration program; the (4) wizard-ids or (5) pager-new-identifier parameter in a firewall-filters action to the configuration program; (6) the cos-physical-interface-name parameter in a cos-physical-interfaces-edit action to the configuration program; the (7) wizard-args or (8) wizard-ids parameter in an snmp action to the configuration program; the (9) username or (10) fullname parameter in a users action to the configuration program; or the (11) certname or (12) certbody parameter in a local-cert (aka https) action to the configuration program.
Configurations

Configuration 1 (hide)

cpe:2.3:o:juniper:junos:8.5:r1.14:*:*:*:*:*:*

History

No history.

Information

Published : 2009-09-30 15:30

Updated : 2024-02-04 17:33


NVD link : CVE-2009-3486

Mitre link : CVE-2009-3486

CVE.ORG link : CVE-2009-3486


JSON object : View

Products Affected

juniper

  • junos
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')