PT-2019-1367 · Juniper Networks · Juniper Atp

Published 2019-01-15 · Updated 2019-10-09 · CVE-2019-0026

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3

Description The issue is related to insufficient input validation in the Zone configuration component of Juniper ATP, which may allow a remote attacker to inject arbitrary JavaScript code into a loaded page and access protected data. This is a persistent cross-site scripting (XSS) issue that can be exploited by an authenticated user to steal sensitive data and credentials from a web administration session. The attacker may also trick a subsequent administrative user into performing administrative actions on the device.

Recommendations For Juniper ATP versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Zone configuration component to minimize the risk of exploitation. Avoid using the vulnerable Zone configuration feature until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-00728

CVE-2019-0026

Affected Products

Juniper Atp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0026 · Security Note
• https://kb.juniper.net/JSA10918 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00728 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0026 · Vendor Advisory
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST · Note