Medium severity · published Jul 17, 2017
CVE-2017-2338
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to…
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Screenos · Juniper
6.3.0; 6.3.0; 6.3.0; 6.3.0; 6.3.0; 6.3.0; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2338
Third Party Advisory
http://www.securityfocus.com/bid/99590
Third Party Advisory
http://www.securitytracker.com/id/1038881
Vendor Advisory
https://kb.juniper.net/JSA10782
More from Screenos
9.8
CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability
8.1
CVE-2015-7754
Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted…
7.5
CVE-2016-1268
The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet
6.5
CVE-2018-0014
Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets
5.4
CVE-2017-2339
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to…