Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2019-0047
PUBLISHED
More InfoOfficial Page
Assigner-juniper
Assigner Org ID-8cbe9d5a-a066-4c94-8978-4b15efeae968
View Known Exploited Vulnerability (KEV) details
Published At-09 Oct, 2019 | 19:26
Updated At-17 Sep, 2024 | 01:55
Rejected At-
▼CVE Numbering Authority (CNA)
Junos OS: Persistent XSS vulnerability in J-Web

A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue affects: Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.

Affected Products
Vendor
Juniper Networks, Inc.Juniper Networks
Product
Junos OS
Versions
Affected
  • From 12.1X46 before 12.1X46-D86 (custom)
  • From 12.3 before 12.3R12-S13 (custom)
  • From 12.3X48 before 12.3X48-D80 (custom)
  • From 14.1X53 before 14.1X53-D51 (custom)
  • From 15.1 before 15.1F6-S13, 15.1R7-S4 (custom)
  • From 15.1X49 before 15.1X49-D171, 15.1X49-D180 (custom)
  • From 15.1X53 before 15.1X53-D497, 15.1X53-D69 (custom)
  • From 16.1 before 16.1R7-S5 (custom)
  • From 16.2 before 16.2R2-S9 (custom)
  • From 17.1 before 17.1R3 (custom)
  • From 17.2 before 17.2R1-S8, 17.2R2-S7, 17.2R3-S1 (custom)
  • From 17.3 before 17.3R3-S6 (custom)
  • From 17.4 before 17.4R1-S7, 17.4R2-S4, 17.4R3 (custom)
  • From 18.1 before 18.1R3-S5 (custom)
  • From 18.2 before 18.2R1-S5, 18.2R2-S3, 18.2R3 (custom)
  • From 18.3 before 18.3R1-S3, 18.3R2, 18.3R3 (custom)
  • From 18.4 before 18.4R1-S2, 18.4R2 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-79CWE-79 Cross-site Scripting (XSS)
Metrics
VersionBase scoreBase severityVector
3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

The following software releases have been updated to resolve this specific issue: 12.1X46-D86, 12.3R12-S13, 12.3X48-D80, 14.1X53-D51, 15.1F6-S13, 15.1R7-S4, 15.1X49-D171, 15.1X49-D180, 15.1X53-D497, 15.1X53-D69, 16.1R7-S5, 16.2R2-S9, 17.1R3, 17.2R1-S8, 17.2R2-S7, 17.2R3-S1, 17.3R3-S6, 17.4R1-S7, 17.4R2-S4, 17.4R3, 18.1R3-S5, 18.2R1-S5, 18.2R2-S3, 18.2R3, 18.3R1-S3, 18.3R2, 18.4R1-S2, 18.4R2, 19.1R1, and all subsequent releases.

Configurations

Successful exploitation require J-Web to be enabled on the device. The examples of the config stanza affected by this issue: system services web-management http system services web-management https

Workarounds

Disable J-Web. Limit access to the Junos device to only trusted hosts and networks.

Exploits

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

Credits
Farid Heydari
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.juniper.net/JSA10970
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.juniper.net/JSA10970
x_refsource_MISC
x_transferred
Details not found