Juniper ScreenOS < 5.4.0r10 / 6.0 < 6.0.0r6 / 6.1 < 6.1.0r2 Web Interface and Telnet Login Pages XSS (JSA10388)

medium Nessus Plugin ID 74365

Language:

Synopsis

The remote host is affected by a cross-site scripting vulnerability.

Description

The remote host is running a version of Juniper ScreenOS prior to 5.4.0r10 / 6.0.0r6 / 6.1.0r2. It is, therefore, affected by a cross-site scripting vulnerability due to improperly sanitizing user input to the web interface and telnet login pages. An attacker could exploit this vulnerability by tricking a user into requesting a maliciously crafted URL, resulting in arbitrary script code execution.

Solution

Upgrade to 5.4.0r10 / 6.0.0r6 / 6.1.0r2 or later or refer to the vendor for a workaround.

Plugin Details

Severity: Medium

ID: 74365

File Name: screenos_JSA10388.nasl

Version: 1.5

Type: local

Family: CGI abuses : XSS

Published: 6/6/2014

Updated: 1/19/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:juniper:screenos

Required KB Items: Settings/ParanoidReport, Host/Juniper/ScreenOS/display_version, Host/Juniper/ScreenOS/version

Exploit Ease: No exploit is required

Patch Publication Date: 5/16/2008

Vulnerability Publication Date: 10/1/2008

Reference Information

CVE: CVE-2008-6096

BID: 31528

CWE: 79

Detections

Analytics