PT-2018-1761 · Opennms+1 · Opennms+1

Published 2018-10-10 · Updated 2019-10-09 · CVE-2018-0046

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 18.2R1

Description A reflected cross-site scripting issue in OpenNMS, included with Juniper Networks Junos Space, may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. The issue is caused by insufficient protection of the web page structure, which can be exploited by a remote attacker to disclose protected information or perform actions on behalf of an administrator.

Recommendations For Juniper Networks Junos Space versions prior to 18.2R1, update to version 18.2R1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected web pages or disabling the vulnerable OpenNMS component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01361

CVE-2018-0046

Affected Products

Junos Space

Opennms

References · 9

• https://github.com/OpenNMS/opennms/commit/8710463077c10034fcfa06556a98fb1a1a64fd0d · Patch
• https://osv.dev/vulnerability/CVE-2018-0046 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01361 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0046 · Security Note
• https://kb.juniper.net/JSA10880 · Vendor Advisory
• http://securityfocus.com/bid/105566 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880 · Note
• http://securitytracker.com/id/1041862 · Note