CVE-2018-0059: ScreenOS: Stored Cross-Site Scripting (XSS) vulnerability

Published Oct 10, 2018

Updated

A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26.

Affected Software

27 affected components

Juniper NetScreen ScreenOS=6.3.0

Juniper NetScreen ScreenOS=6.3.0r1

Juniper NetScreen ScreenOS=6.3.0r2

Juniper NetScreen ScreenOS=6.3.0r3

Juniper NetScreen ScreenOS=6.3.0r4

Juniper NetScreen ScreenOS=6.3.0r5

Juniper NetScreen ScreenOS=6.3.0r6

Juniper NetScreen ScreenOS=6.3.0r7

Juniper NetScreen ScreenOS=6.3.0r8

Juniper NetScreen ScreenOS=6.3.0r9

Juniper NetScreen ScreenOS=6.3.0r10

Juniper NetScreen ScreenOS=6.3.0r11

Juniper NetScreen ScreenOS=6.3.0r12

Juniper NetScreen ScreenOS=6.3.0r13

Juniper NetScreen ScreenOS=6.3.0r14

Juniper NetScreen ScreenOS=6.3.0r15

Juniper NetScreen ScreenOS=6.3.0r16

Juniper NetScreen ScreenOS=6.3.0r17

Juniper NetScreen ScreenOS=6.3.0r18

Juniper NetScreen ScreenOS=6.3.0r19

Juniper NetScreen ScreenOS=6.3.0r21

Juniper NetScreen ScreenOS=6.3.0r22

Juniper NetScreen ScreenOS=6.3.0r23

Juniper NetScreen ScreenOS=6.3.0r23b1

Juniper NetScreen ScreenOS=6.3.0r24

Juniper NetScreen ScreenOS=6.3.0r24b1

Juniper NetScreen ScreenOS=6.3.0r25

Remediation

Information

The following software releases have been updated to resolve this specific issue: ScreenOS 6.3.0r26 and all subsequent releases. Review and clear any previously stored cross-site scripting entries.

Event History

Oct 10, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0059?

CVE-2018-0059 has a medium severity rating due to its potential to allow cross-site scripting attacks that can compromise sensitive information.

How do I fix CVE-2018-0059?

To fix CVE-2018-0059, you should upgrade your Juniper NetScreen ScreenOS to version 6.3.0r26 or later.

What type of vulnerability is CVE-2018-0059?

CVE-2018-0059 is a persistent cross-site scripting vulnerability that can allow unauthorized script injection.

Who is affected by CVE-2018-0059?

CVE-2018-0059 affects remote authenticated users of the Juniper NetScreen ScreenOS versions 6.3.0 through 6.3.0r25.

What are the potential risks of CVE-2018-0059?

The risks associated with CVE-2018-0059 include the potential for attackers to steal sensitive data and credentials during web administration sessions.