CVE-2018-0047

moderate-risk

Published 2018-10-10

A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2.

Do I need to act?

0.32% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.0/10 High

NETWORK / LOW complexity

Affected Products (16)

Junos Space

Affected Vendors

Juniper

References (4)

Third Party Advisory http://www.securitytracker.com/id/1041863

Vendor Advisory https://kb.juniper.net/JSA10881

Third Party Advisory http://www.securitytracker.com/id/1041863

Vendor Advisory https://kb.juniper.net/JSA10881

/ 100

moderate-risk

Severity 28/34 · Critical

Exploitability 1/34 · Minimal

Exposure 18/34 · Moderate