CVE-2016-1261
7.1
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS | 12.1X44 prior to 12.1X44-D55 | affected |
| Juniper Networks | Junos OS | 12.1X46 prior to 12.1X46-D45 | affected |
| Juniper Networks | Junos OS | 12.1X47 prior to 12.1X47-D30 | affected |
| Juniper Networks | Junos OS | 12.3 prior to 12.3R11 | affected |
| Juniper Networks | Junos OS | 12.3X48 prior to 12.3X48-D30 | affected |
| Juniper Networks | Junos OS | 13.2X51 prior to 13.2X51-D40 | affected |
| Juniper Networks | Junos OS | 13.3 prior to 13.3R8 | affected |
| Juniper Networks | Junos OS | 14.1 prior to 14.1R6 | affected |
| Juniper Networks | Junos OS | 14.1X53 prior to 14.1X53-D30 | affected |
| Juniper Networks | Junos OS | 14.2 prior to 14.2R5 | affected |
| Juniper Networks | Junos OS | 15.1 prior to 15.1R3 | affected |
| Juniper Networks | Junos OS | 15.1X49 prior to 15.1X49-D20 | affected |
Weaknesses
- failure to validate input
Workarounds
Disable J-Web, or limit access to only trusted hosts which may not be compromised by cross-site attacks. For example, deploy jump hosts with no Internet access that use anti-scripting techniques to mitigate potential threats. Alternately, use a dedicated client and dedicated Web browser that is not used to access other sites.
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.