fkie_nvd - fkie_cve-2018-0047

FKIE_CVE-2018-0047

Vulnerability from fkie_nvd - Published: 2018-10-10 18:29 - Updated: 2024-11-21 03:37

Severity ?

8.0 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2.

References

URL	Tags
sirt@juniper.net	http://www.securitytracker.com/id/1041863	Third Party Advisory, VDB Entry
sirt@juniper.net	https://kb.juniper.net/JSA10881	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1041863	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://kb.juniper.net/JSA10881	Vendor Advisory

Impacted products

Vendor	Product	Version
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	14.1
juniper	junos_space	14.1
juniper	junos_space	14.1
juniper	junos_space	15.1
juniper	junos_space	15.1
juniper	junos_space	15.1
juniper	junos_space	15.1
juniper	junos_space	15.2
juniper	junos_space	15.2
juniper	junos_space	16.1
juniper	junos_space	16.1
juniper	junos_space	16.1
juniper	junos_space	17.1
juniper	junos_space	17.2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:13.3:r1:*:*:*:*:*:*",
              "matchCriteriaId": "3690DD20-F4FF-4388-899E-884D60052199",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:13.3:r2:*:*:*:*:*:*",
              "matchCriteriaId": "642062E4-FCD1-4C96-9832-8B65D1D327D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:14.1:r1:*:*:*:*:*:*",
              "matchCriteriaId": "BA50737C-5924-490D-8A1C-C7913264D458",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:14.1:r2:*:*:*:*:*:*",
              "matchCriteriaId": "6EB0159B-4D22-40E1-AD55-17D7A8AA4CAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:14.1:r3:*:*:*:*:*:*",
              "matchCriteriaId": "C157A9EB-482F-4060-9A60-0D149D656665",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.1:r1:*:*:*:*:*:*",
              "matchCriteriaId": "CC5AA529-494F-4297-88FE-4C58B8FCA8F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.1:r2:*:*:*:*:*:*",
              "matchCriteriaId": "0C01B9DB-ADFF-4652-8040-572715370BDF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.1:r3:*:*:*:*:*:*",
              "matchCriteriaId": "DE27435E-F321-4CD6-AB9E-AF2F50057A03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.1:r4:*:*:*:*:*:*",
              "matchCriteriaId": "3716BA1C-FFDF-4939-8AE6-68BFB06CDD53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "0F319D4E-938C-44AF-868A-FBFF077D6139",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:15.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "0FE562A7-779A-4B7C-9A1E-3EF141D798B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:16.1:r1:*:*:*:*:*:*",
              "matchCriteriaId": "882C4D7A-293C-4587-84B1-822F63D53D2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:16.1:r2:*:*:*:*:*:*",
              "matchCriteriaId": "4A98BA3F-35BD-4C8D-80B4-B85C3B32F5AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:16.1:r3:*:*:*:*:*:*",
              "matchCriteriaId": "FE3823E7-6A1D-4645-94C5-01EBB2392B69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:17.1:r1:*:*:*:*:*:*",
              "matchCriteriaId": "3DFF54CC-E24F-42B4-B908-AECD1139146B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_space:17.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "2E80FD6E-A2E7-4B8C-BFC8-D9B0F32245C7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad Cross-Site Scripting (XSS) persistente en el la interfaz del framework empleado por Junos Space Security Director podr\u00eda permitir que usuarios autenticados inyecten scripts persistentes y maliciosos. Esto podr\u00eda permitir el robo de informaci\u00f3n o la realizaci\u00f3n de acciones como otro usuario cuando otros acceden a la interfaz web de Security Director. Este problema afecta a todas las versiones de Juniper Networks Junos Space Security Director en versiones anteriores a la 17.2R2."
    }
  ],
  "id": "CVE-2018-0047",
  "lastModified": "2024-11-21T03:37:25.683",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "sirt@juniper.net",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-10T18:29:01.517",
  "references": [
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1041863"
    },
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10881"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1041863"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10881"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2018-0047 (GCVE-0-2018-0047)

Vulnerability from cvelistv5 – Published: 2018-10-10 18:00 – Updated: 2024-09-16 17:38

Summary

Severity ?

8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

Persistent Cross-Site Scripting Vulnerability

Assigner

juniper

References

URL

Tags

	http://www.securitytracker.com/id/1041863	vdb-entryx_refsource_SECTRACK
	https://kb.juniper.net/JSA10881	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Juniper Networks	Junos Space Security Director	Affected: unspecified , ≤ 17.2R2 (custom)

Credits

Marcel Bilal of IT-Dienstleistungszentrum Berlin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:14:16.663Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1041863",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041863"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/JSA10881"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Junos Space Security Director",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThanOrEqual": "17.2R2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marcel Bilal of IT-Dienstleistungszentrum Berlin"
        }
      ],
      "datePublic": "2018-10-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Persistent Cross-Site Scripting Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T09:57:01",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "name": "1041863",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041863"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.juniper.net/JSA10881"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The following software releases have been updated to resolve this specific issue: Junos Space Security Director 17.2R2, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA10881",
        "defect": [
          "1337620"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Junos Space Security Director: XSS vulnerability in web administration",
      "workarounds": [
        {
          "lang": "en",
          "value": "Restrict access to the Junos Space Security Director dashboard to trusted users."
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@juniper.net",
          "DATE_PUBLIC": "2018-10-10T16:00:00.000Z",
          "ID": "CVE-2018-0047",
          "STATE": "PUBLIC",
          "TITLE": "Junos Space Security Director: XSS vulnerability in web administration"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Junos Space Security Director",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "17.2R2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Juniper Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Marcel Bilal of IT-Dienstleistungszentrum Berlin"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
          }
        ],
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Persistent Cross-Site Scripting Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1041863",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041863"
            },
            {
              "name": "https://kb.juniper.net/JSA10881",
              "refsource": "CONFIRM",
              "url": "https://kb.juniper.net/JSA10881"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The following software releases have been updated to resolve this specific issue: Junos Space Security Director 17.2R2, and all subsequent releases."
          }
        ],
        "source": {
          "advisory": "JSA10881",
          "defect": [
            "1337620"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Restrict access to the Junos Space Security Director dashboard to trusted users."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2018-0047",
    "datePublished": "2018-10-10T18:00:00Z",
    "dateReserved": "2017-11-16T00:00:00",
    "dateUpdated": "2024-09-16T17:38:13.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2018-0047

CVE-2018-0047 (GCVE-0-2018-0047)

Tags

Sightings

Nomenclature