CVE-2019-0047
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue affects: Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS | 12.1X46 < 12.1X46-D86 | affected |
| Juniper Networks | Junos OS | 12.3 < 12.3R12-S13 | affected |
| Juniper Networks | Junos OS | 12.3X48 < 12.3X48-D80 | affected |
| Juniper Networks | Junos OS | 14.1X53 < 14.1X53-D51 | affected |
| Juniper Networks | Junos OS | 15.1 < 15.1F6-S13, 15.1R7-S4 | affected |
| Juniper Networks | Junos OS | 15.1X49 < 15.1X49-D171, 15.1X49-D180 | affected |
| Juniper Networks | Junos OS | 15.1X53 < 15.1X53-D497, 15.1X53-D69 | affected |
| Juniper Networks | Junos OS | 16.1 < 16.1R7-S5 | affected |
| Juniper Networks | Junos OS | 16.2 < 16.2R2-S9 | affected |
| Juniper Networks | Junos OS | 17.1 < 17.1R3 | affected |
| Juniper Networks | Junos OS | 17.2 < 17.2R1-S8, 17.2R2-S7, 17.2R3-S1 | affected |
| Juniper Networks | Junos OS | 17.3 < 17.3R3-S6 | affected |
| Juniper Networks | Junos OS | 17.4 < 17.4R1-S7, 17.4R2-S4, 17.4R3 | affected |
| Juniper Networks | Junos OS | 18.1 < 18.1R3-S5 | affected |
| Juniper Networks | Junos OS | 18.2 < 18.2R1-S5, 18.2R2-S3, 18.2R3 | affected |
| Juniper Networks | Junos OS | 18.3 < 18.3R1-S3, 18.3R2, 18.3R3 | affected |
| Juniper Networks | Junos OS | 18.4 < 18.4R1-S2, 18.4R2 | affected |
Weaknesses
- CWE-79: CWE-79 Cross-site Scripting (XSS)
Workarounds
Disable J-Web. Limit access to the Junos device to only trusted hosts and networks.
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.