PT-2017-15365 · Juniper Networks · Netscreen Firewall+Vpn

Published 2017-07-14 · Updated 2017-07-22 · CVE-2017-2336

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper NetScreen Firewall+VPN versions prior to 6.3.0r24

Description A reflected cross-site scripting issue in the NetScreen WebUI allows a network-based attacker to inject HTML/JavaScript content into the management session of other users, including the administrator. This enables the attacker to execute commands with the permissions of an administrator.

Recommendations For versions prior to 6.3.0r24, update to version 6.3.0r24 or later to resolve the issue. As a temporary workaround, consider restricting access to the NetScreen WebUI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-2336

Affected Products

Netscreen Firewall+Vpn

References · 5

• https://osv.dev/vulnerability/CVE-2017-2336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2336 · Security Note
• https://kb.juniper.net/JSA10782 · Vendor Advisory
• http://securitytracker.com/id/1038881 · Note
• http://securityfocus.com/bid/99590 · Note