Skip to content

CVE-2017-2335 ScreenOS: XSS vulnerability in ScreenOS Firewall

MediumCVSS 5.4 EPSS 1.1%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.

Affected products

ProductAffected versionsFixed in
juniper screenos = 6.3.0 No fix listed
juniper screenos = 6.3.0-r1 No fix listed
juniper screenos = 6.3.0-r10 No fix listed
juniper screenos = 6.3.0-r11 No fix listed
juniper screenos = 6.3.0-r12 No fix listed
juniper screenos = 6.3.0-r13 No fix listed
juniper screenos = 6.3.0-r14 No fix listed
juniper screenos = 6.3.0-r15 No fix listed
juniper screenos = 6.3.0-r16 No fix listed
juniper screenos = 6.3.0-r17 No fix listed
juniper screenos = 6.3.0-r18 No fix listed
juniper screenos = 6.3.0-r19 No fix listed
juniper screenos = 6.3.0-r2 No fix listed
juniper screenos = 6.3.0-r21 No fix listed
juniper screenos = 6.3.0-r22 No fix listed
juniper screenos = 6.3.0-r23 No fix listed
juniper screenos = 6.3.0-r23b No fix listed
juniper screenos = 6.3.0-r3 No fix listed
juniper screenos = 6.3.0-r4 No fix listed
juniper screenos = 6.3.0-r5 No fix listed
juniper screenos = 6.3.0-r6 No fix listed
juniper screenos = 6.3.0-r7 No fix listed
juniper screenos = 6.3.0-r8 No fix listed
juniper screenos = 6.3.0-r9 No fix listed
juniper screenos = 6.3.0 prior to 6.3.0r24 No fix listed

References