CVE-2017-2335

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
References
Link Resource
http://www.securityfocus.com/bid/99590 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038881 Third Party Advisory VDB Entry
https://kb.juniper.net/JSA10782 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:juniper:screenos:6.3.0:*:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r10:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r11:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r13:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r21:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r22:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r23:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r23b:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r4:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r5:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r6:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r7:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r8:*:*:*:*:*:*
cpe:2.3:o:juniper:screenos:6.3.0:r9:*:*:*:*:*:*

History

No history.

Information

Published : 2017-07-17 13:18

Updated : 2024-02-04 19:29


NVD link : CVE-2017-2335

Mitre link : CVE-2017-2335

CVE.ORG link : CVE-2017-2335


JSON object : View

Products Affected

juniper

  • screenos
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')