CVE-2018-0059: ScreenOS: Stored Cross-Site Scripting (XSS) vulnerability
First published: Wed Oct 10 2018(Updated: )
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper NetScreen ScreenOS | =6.3.0 | |
| Juniper NetScreen ScreenOS | =6.3.0r1 | |
| Juniper NetScreen ScreenOS | =6.3.0r2 | |
| Juniper NetScreen ScreenOS | =6.3.0r3 | |
| Juniper NetScreen ScreenOS | =6.3.0r4 | |
| Juniper NetScreen ScreenOS | =6.3.0r5 | |
| Juniper NetScreen ScreenOS | =6.3.0r6 | |
| Juniper NetScreen ScreenOS | =6.3.0r7 | |
| Juniper NetScreen ScreenOS | =6.3.0r8 | |
| Juniper NetScreen ScreenOS | =6.3.0r9 | |
| Juniper NetScreen ScreenOS | =6.3.0r10 | |
| Juniper NetScreen ScreenOS | =6.3.0r11 | |
| Juniper NetScreen ScreenOS | =6.3.0r12 | |
| Juniper NetScreen ScreenOS | =6.3.0r13 | |
| Juniper NetScreen ScreenOS | =6.3.0r14 | |
| Juniper NetScreen ScreenOS | =6.3.0r15 | |
| Juniper NetScreen ScreenOS | =6.3.0r16 | |
| Juniper NetScreen ScreenOS | =6.3.0r17 | |
| Juniper NetScreen ScreenOS | =6.3.0r18 | |
| Juniper NetScreen ScreenOS | =6.3.0r19 | |
| Juniper NetScreen ScreenOS | =6.3.0r21 | |
| Juniper NetScreen ScreenOS | =6.3.0r22 | |
| Juniper NetScreen ScreenOS | =6.3.0r23 | |
| Juniper NetScreen ScreenOS | =6.3.0r23b1 | |
| Juniper NetScreen ScreenOS | =6.3.0r24 | |
| Juniper NetScreen ScreenOS | =6.3.0r24b1 | |
| Juniper NetScreen ScreenOS | =6.3.0r25 |
Remedy
The following software releases have been updated to resolve this specific issue: ScreenOS 6.3.0r26 and all subsequent releases. Review and clear any previously stored cross-site scripting entries.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/severity
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/event
- vendor/juniper
- canonical/juniper netscreen screenos
- version/juniper netscreen screenos/6.3.0
- version/juniper netscreen screenos/6.3.0r1
- version/juniper netscreen screenos/6.3.0r2
- version/juniper netscreen screenos/6.3.0r3
- version/juniper netscreen screenos/6.3.0r4
- version/juniper netscreen screenos/6.3.0r5
- version/juniper netscreen screenos/6.3.0r6
- version/juniper netscreen screenos/6.3.0r7
- version/juniper netscreen screenos/6.3.0r8
- version/juniper netscreen screenos/6.3.0r9
- version/juniper netscreen screenos/6.3.0r10
- version/juniper netscreen screenos/6.3.0r11
- version/juniper netscreen screenos/6.3.0r12
- version/juniper netscreen screenos/6.3.0r13
- version/juniper netscreen screenos/6.3.0r14
- version/juniper netscreen screenos/6.3.0r15
- version/juniper netscreen screenos/6.3.0r16
- version/juniper netscreen screenos/6.3.0r17
- version/juniper netscreen screenos/6.3.0r18
- version/juniper netscreen screenos/6.3.0r19
- version/juniper netscreen screenos/6.3.0r21
- version/juniper netscreen screenos/6.3.0r22
- version/juniper netscreen screenos/6.3.0r23
- version/juniper netscreen screenos/6.3.0r23b1
- version/juniper netscreen screenos/6.3.0r24
- version/juniper netscreen screenos/6.3.0r24b1
- version/juniper netscreen screenos/6.3.0r25