CVE-2018-0011: Junos Space: Reflected XSS vulnerability in Junos Space management interface

Published Jan 10, 2018

Updated

A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device.

Affected Software

15 affected components

Juniper Junos Space=13.3-r1

Juniper Junos Space=13.3-r2

Juniper Junos Space=13.3-r4

Juniper Junos Space=14.1-r1

Juniper Junos Space=14.1-r2

Juniper Junos Space=14.1-r3

Juniper Junos Space=15.1-r1

Juniper Junos Space=15.1-r2

Juniper Junos Space=15.1-r3

Juniper Junos Space=15.2-r1

Juniper Junos Space=15.2-r2

Juniper Junos Space=16.1-r1

Juniper Junos Space=16.1-r2

Juniper Junos Space=16.1-r3

Juniper Junos Space=17.1-r1

Remediation

Patch Available

https://kb.juniper.net/JSA10838

Information

The following software releases have been updated to resolve this specific issue: Junos Space 17.2R1 and all subsequent releases.

Event History

Jan 10, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0011?

CVE-2018-0011 has a medium severity rating due to its potential impact on sensitive data and session security.

How do I fix CVE-2018-0011?

To mitigate CVE-2018-0011, upgrade Junos Space to a version that resolves this reflected XSS vulnerability.

What causes CVE-2018-0011?

CVE-2018-0011 is caused by improper input validation allowing a remote authenticated user to inject malicious scripts.

Who is affected by CVE-2018-0011?

CVE-2018-0011 affects authenticated users of specific versions of Junos Space network management software.

What can attackers achieve with CVE-2018-0011?

Exploiting CVE-2018-0011 allows attackers to steal sensitive user data, credentials, and perform unauthorized administrative actions.