CVE-2021-31373

Summary

A persistent Cross-Site Scripting (XSS) vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web administration session, or hijack another user's active session to perform administrative actions. This issue affects: Juniper Networks Junos OS on SRX Series: 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3-S1; 20.3 versions prior to 20.3R2-S1, 20.3R3.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS18.2 < 18.2R3-S8affected
Juniper NetworksJunos OS18.3 < 18.3R3-S5affected
Juniper NetworksJunos OS18.4 < 18.4R3-S8affected
Juniper NetworksJunos OS19.1 < 19.1R3-S5affected
Juniper NetworksJunos OS19.2 < 19.2R1-S7, 19.2R3-S3affected
Juniper NetworksJunos OS19.3 < 19.3R2-S6, 19.3R3-S3affected
Juniper NetworksJunos OS19.4 < 19.4R1-S4, 19.4R2-S4, 19.4R3-S3affected
Juniper NetworksJunos OS20.1 < 20.1R2-S2, 20.1R3affected
Juniper NetworksJunos OS20.2 < 20.2R3-S1affected
Juniper NetworksJunos OS20.3 < 20.3R2-S1, 20.3R3affected

Weaknesses

  • CWE-20: CWE-20 Improper Input Validation
  • CWE-79: CWE-79 Cross-site Scripting (XSS)

Workarounds

To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted administrative networks, hosts and users.

Alternatively, J-Web can be disabled.

ADP Enrichment

CVE Program Container

Additional References

References