CVE-2018-0047: Junos Space Security Director: XSS vulnerability in web administration

Published Oct 10, 2018

Updated

A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2.

Affected Software

16 affected components

Juniper Junos Space=13.3-r1

Juniper Junos Space=13.3-r2

Juniper Junos Space=14.1-r1

Juniper Junos Space=14.1-r2

Juniper Junos Space=14.1-r3

Juniper Junos Space=15.1-r1

Juniper Junos Space=15.1-r2

Juniper Junos Space=15.1-r3

Juniper Junos Space=15.1-r4

Juniper Junos Space=15.2-r1

Juniper Junos Space=15.2-r2

Juniper Junos Space=16.1-r1

Juniper Junos Space=16.1-r2

Juniper Junos Space=16.1-r3

Juniper Junos Space=17.1-r1

Juniper Junos Space=17.2-r1

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos Space Security Director 17.2R2, and all subsequent releases.

Event History

Oct 10, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0047?

CVE-2018-0047 has a medium severity level due to its potential for persistent cross-site scripting in Junos Space Security Director.

How do I fix CVE-2018-0047?

To fix CVE-2018-0047, update your Junos Space Security Director to the latest patched version provided by Juniper Networks.

Which versions of Junos Space are affected by CVE-2018-0047?

CVE-2018-0047 affects numerous versions of Junos Space, including 13.3 through 17.2.

What type of vulnerability is CVE-2018-0047?

CVE-2018-0047 is categorized as a persistent cross-site scripting vulnerability.

Who can exploit CVE-2018-0047?

Authenticated users can exploit CVE-2018-0047 to inject malicious scripts into the Junos Space Security Director.