Detections
Analytics
Juniper Junos J-Web Persistent XSS (JSA10619)
medium Nessus Plugin ID 73493
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its self-reported version number, the remote Junos device is affected by a stored cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the J-Web interface. An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the end-user's browser.Note that this issue only affects devices with J-Web enabled.
Solution
Apply the relevant Junos software release or workaround referenced in Juniper advisory JSA10619.See Also
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10619
Plugin Details
Severity: Medium
ID: 73493
File Name: juniper_jsa10619.nasl
Version: 1.9
Type: combined
Family: Junos Local Security Checks
Published: 4/14/2014
Updated: 7/12/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/o:juniper:junos
Required KB Items: Host/Juniper/JUNOS/Version, Host/Juniper/JUNOS/BuildDate
Exploit Ease: No known exploits are available
Patch Publication Date: 3/20/2014
Vulnerability Publication Date: 4/9/2014
Reference Information
CVE: CVE-2014-2711
BID: 66770