Medium severity · published Oct 10, 2018
CVE-2018-0046
A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from…
6.1
CVSS
1.6%
EPSS
No
On KEV
Description
A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. This issue affects Juniper Networks Junos Space versions prior to 18.2R1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper
18.1r1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0046
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0046
Third Party Advisory
http://www.securityfocus.com/bid/105566
Third Party Advisory
http://www.securitytracker.com/id/1041862
Patch
https://github.com/OpenNMS/opennms/commit/8710463077c10034fcfa06556a98fb1a1a64fd0d
Vendor Advisory
https://kb.juniper.net/JSA10880
More from Junos Space
9.8
CVE-2014-3413
The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive…
9.8
CVE-2017-10622
An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to login as any…
9.8
CVE-2016-1265
A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross…
9.8
CVE-2016-4926
Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative…
9.0
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application