CVE-2014-2712

2014-04-1415:09:06

CWE-79

mitre

web.nvd.nist.gov

cve-2014-2712

cross-site scripting

xss

j-web

juniper junos

remote attack

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php.

Affected configurations

Nvd

Node

juniperjunosMatch10.0

juniperjunosMatch10.4

juniperjunosMatch11.4

juniperjunosMatch12.1

juniperjunosMatch12.1x44

juniperjunosMatch12.1x45

juniperjunosMatch12.1x46

juniperjunosMatch12.2

VendorProductVersionCPE
juniperjunos10.0cpe:2.3:o:juniper:junos:10.0:*:*:*:*:*:*:*
juniperjunos10.4cpe:2.3:o:juniper:junos:10.4:*:*:*:*:*:*:*
juniperjunos11.4cpe:2.3:o:juniper:junos:11.4:*:*:*:*:*:*:*
juniperjunos12.1cpe:2.3:o:juniper:junos:12.1:*:*:*:*:*:*:*
juniperjunos12.1x44cpe:2.3:o:juniper:junos:12.1x44:*:*:*:*:*:*:*
juniperjunos12.1x45cpe:2.3:o:juniper:junos:12.1x45:*:*:*:*:*:*:*
juniperjunos12.1x46cpe:2.3:o:juniper:junos:12.1x46:*:*:*:*:*:*:*
juniperjunos12.2cpe:2.3:o:juniper:junos:12.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
juniper	junos	10.0	cpe:2.3:o:juniper:junos:10.0:::::::*
juniper	junos	10.4	cpe:2.3:o:juniper:junos:10.4:::::::*
juniper	junos	11.4	cpe:2.3:o:juniper:junos:11.4:::::::*
juniper	junos	12.1	cpe:2.3:o:juniper:junos:12.1:::::::*
juniper	junos	12.1x44	cpe:2.3:o:juniper:junos:12.1x44:::::::*
juniper	junos	12.1x45	cpe:2.3:o:juniper:junos:12.1x45:::::::*
juniper	junos	12.1x46	cpe:2.3:o:juniper:junos:12.1x46:::::::*
juniper	junos	12.2	cpe:2.3:o:juniper:junos:12.2:::::::*