PT-2021-19271 · Juniper Networks · Junos

Published 2021-10-19 · Updated 2021-10-27 · CVE-2021-31373

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series versions 18.2 through 18.2R3-S8 Juniper Networks Junos OS on SRX Series versions 18.3 through 18.3R3-S5 Juniper Networks Junos OS on SRX Series versions 18.4 through 18.4R3-S8 Juniper Networks Junos OS on SRX Series versions 19.1 through 19.1R3-S5 Juniper Networks Junos OS on SRX Series versions 19.2 through 19.2R1-S7 Juniper Networks Junos OS on SRX Series versions 19.2 through 19.2R3-S3 Juniper Networks Junos OS on SRX Series versions 19.3 through 19.3R2-S6 Juniper Networks Junos OS on SRX Series versions 19.3 through 19.3R3-S3 Juniper Networks Junos OS on SRX Series versions 19.4 through 19.4R1-S4 Juniper Networks Junos OS on SRX Series versions 19.4 through 19.4R2-S4 Juniper Networks Junos OS on SRX Series versions 19.4 through 19.4R3-S3 Juniper Networks Junos OS on SRX Series versions 20.1 through 20.1R2-S2 Juniper Networks Junos OS on SRX Series versions 20.1 through 20.1R3 Juniper Networks Junos OS on SRX Series versions 20.2 through 20.2R3-S1 Juniper Networks Junos OS on SRX Series versions 20.3 through 20.3R2-S1 Juniper Networks Junos OS on SRX Series versions 20.3 through 20.3R3

Description A persistent Cross-Site Scripting (XSS) vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web administration session, or hijack another user's active session to perform administrative actions.

Recommendations For versions 18.2 through 18.2R3-S8, update to version 18.2R3-S8 or later. For versions 18.3 through 18.3R3-S5, update to version 18.3R3-S5 or later. For versions 18.4 through 18.4R3-S8, update to version 18.4R3-S8 or later. For versions 19.1 through 19.1R3-S5, update to version 19.1R3-S5 or later. For versions 19.2 through 19.2R1-S7, update to version 19.2R1-S7 or later. For versions 19.2 through 19.2R3-S3, update to version 19.2R3-S3 or later. For versions 19.3 through 19.3R2-S6, update to version 19.3R2-S6 or later. For versions 19.3 through 19.3R3-S3, update to version 19.3R3-S3 or later. For versions 19.4 through 19.4R1-S4, update to version 19.4R1-S4 or later. For versions 19.4 through 19.4R2-S4, update to version 19.4R2-S4 or later. For versions 19.4 through 19.4R3-S3, update to version 19.4R3-S3 or later. For versions 20.1 through 20.1R2-S2, update to version 20.1R2-S2 or later. For versions 20.1 through 20.1R3, update to version 20.1R3 or later. For versions 20.2 through 20.2R3-S1, update to version 20.2R3-S1 or later. For versions 20.3 through 20.3R2-S1, update to version 20.3R2-S1 or later. For versions 20.3 through 20.3R3, update to version 20.3R3 or later.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2021-31373

Affected Products

Junos

References · 5

• https://osv.dev/vulnerability/CVE-2021-31373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31373 · Security Note
• https://kb.juniper.net/JSA11238 · Vendor Advisory
• https://t.me/cvenotify/22463 · Telegram Post
• https://t.me/cibsecurity/30821 · Telegram Post