PT-2017-15367 · Juniper Networks · Juniper Netscreen Firewall+Vpn

Publicado 2017-07-14 · Atualizado 2017-07-22 · CVE-2017-2338

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper NetScreen Firewall+VPN versions prior to 6.3.0r24 on SSG Series

Description A persistent cross-site scripting issue in the NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users, including the administrator. This enables the lower-privileged user to execute commands with the permissions of an administrator.

Recommendations For versions prior to 6.3.0r24 on SSG Series, update to version 6.3.0r24 or later to resolve the issue. As a temporary workaround, consider restricting access to the NetScreen WebUI to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-2338

Produtos afetados

Juniper Netscreen Firewall+Vpn

Referências · 5

• http://securitytracker.com/id/1038881 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2338 · Nota de Segurança
• http://securityfocus.com/bid/99590 · Nota
• https://osv.dev/vulnerability/CVE-2017-2338 · Aviso do Fabricante
• https://kb.juniper.net/JSA10782 · Aviso do Fabricante