Lucene search

[email protected]CVE-2024-21620

HistoryJan 25, 2024 - 11:15 p.m.

CVE-2024-21620

2024-01-2523:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-21620

juniper networks

junos os

srx series

ex series

cross-site scripting

command execution

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target’s permissions, including an administrator.

A specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:

All versions earlier than 20.4R3-S10;
21.2 versions earlier than 21.2R3-S8;
21.4 versions earlier than 21.4R3-S6;
22.1 versions earlier than 22.1R3-S5;
22.2 versions earlier than 22.2R3-S3;
22.3 versions earlier than 22.3R3-S2;
22.4 versions earlier than 22.4R3-S1;
23.2 versions earlier than 23.2R2;
23.4 versions earlier than 23.4R2.

Affected configurations

NVD

Node

juniperjunosRange<20.4

juniperjunosMatch20.4-

juniperjunosMatch20.4r1

juniperjunosMatch20.4r1-s1

juniperjunosMatch20.4r2

juniperjunosMatch20.4r2-s1

juniperjunosMatch20.4r2-s2

juniperjunosMatch20.4r3

juniperjunosMatch20.4r3-s1

juniperjunosMatch20.4r3-s2

juniperjunosMatch20.4r3-s3

juniperjunosMatch20.4r3-s4

juniperjunosMatch20.4r3-s5

juniperjunosMatch20.4r3-s6

juniperjunosMatch20.4r3-s7

juniperjunosMatch20.4r3-s8

juniperjunosMatch20.4r3-s9

juniperjunosMatch21.2-

juniperjunosMatch21.2r1

juniperjunosMatch21.2r1-s1

juniperjunosMatch21.2r1-s2

juniperjunosMatch21.2r2

juniperjunosMatch21.2r2-s1

juniperjunosMatch21.2r2-s2

juniperjunosMatch21.2r3

juniperjunosMatch21.2r3-s1

juniperjunosMatch21.2r3-s2

juniperjunosMatch21.2r3-s3

juniperjunosMatch21.2r3-s4

juniperjunosMatch21.2r3-s5

juniperjunosMatch21.2r3-s6

juniperjunosMatch21.2r3-s7

juniperjunosMatch21.4-

juniperjunosMatch21.4r1

juniperjunosMatch21.4r1-s1

juniperjunosMatch21.4r1-s2

juniperjunosMatch21.4r2

juniperjunosMatch21.4r2-s1

juniperjunosMatch21.4r2-s2

juniperjunosMatch21.4r3

juniperjunosMatch21.4r3-s1

juniperjunosMatch21.4r3-s2

juniperjunosMatch21.4r3-s3

juniperjunosMatch21.4r3-s4

juniperjunosMatch21.4r3-s5

juniperjunosMatch22.1-

juniperjunosMatch22.1r1

juniperjunosMatch22.1r1-s1

juniperjunosMatch22.1r1-s2

juniperjunosMatch22.1r2

juniperjunosMatch22.1r2-s1

juniperjunosMatch22.1r2-s2

juniperjunosMatch22.1r3

juniperjunosMatch22.1r3-s1

juniperjunosMatch22.1r3-s2

juniperjunosMatch22.1r3-s3

juniperjunosMatch22.1r3-s4

juniperjunosMatch22.2-

juniperjunosMatch22.2r1

juniperjunosMatch22.2r1-s1

juniperjunosMatch22.2r1-s2

juniperjunosMatch22.2r2

juniperjunosMatch22.2r2-s1

juniperjunosMatch22.2r2-s2

juniperjunosMatch22.2r3

juniperjunosMatch22.2r3-s1

juniperjunosMatch22.2r3-s2

juniperjunosMatch22.3-

juniperjunosMatch22.3r1

juniperjunosMatch22.3r1-s1

juniperjunosMatch22.3r1-s2

juniperjunosMatch22.3r2

juniperjunosMatch22.3r2-s1

juniperjunosMatch22.3r2-s2

juniperjunosMatch22.3r3

juniperjunosMatch22.3r3-s1

juniperjunosMatch22.4-

juniperjunosMatch22.4r1

juniperjunosMatch22.4r1-s1

juniperjunosMatch22.4r1-s2

juniperjunosMatch22.4r2

juniperjunosMatch22.4r2-s1

juniperjunosMatch22.4r2-s2

juniperjunosMatch22.4r3

juniperjunosMatch23.2-

juniperjunosMatch23.2r1

juniperjunosMatch23.2r1-s1

juniperjunosMatch23.2r1-s2

juniperjunosMatch23.4r1

AND

juniperex_redundant_power_systemMatch-

juniperex_rpsMatch-

juniperex2200Match-

juniperex2200-cMatch-

juniperex2200-vcMatch-

juniperex2300Match-

juniperex2300-24mpMatch-

juniperex2300-24pMatch-

juniperex2300-24tMatch-

juniperex2300-48mpMatch-

juniperex2300-48pMatch-

juniperex2300-48tMatch-

juniperex2300-cMatch-

juniperex2300_multigigabitMatch-

juniperex2300mMatch-

juniperex3200Match-

juniperex3300Match-

juniperex3300-vcMatch-

juniperex3400Match-

juniperex4100Match-

juniperex4100-fMatch-

juniperex4100_multigigabitMatch-

juniperex4200Match-

juniperex4200-vcMatch-

juniperex4300Match-

juniperex4300-24pMatch-

juniperex4300-24p-sMatch-

juniperex4300-24tMatch-

juniperex4300-24t-sMatch-

juniperex4300-32fMatch-

juniperex4300-32f-dcMatch-

juniperex4300-32f-sMatch-

juniperex4300-48mpMatch-

juniperex4300-48mp-sMatch-

juniperex4300-48pMatch-

juniperex4300-48p-sMatch-

juniperex4300-48tMatch-

juniperex4300-48t-afiMatch-

juniperex4300-48t-dcMatch-

juniperex4300-48t-dc-afiMatch-

juniperex4300-48t-sMatch-

juniperex4300-48tafiMatch-

juniperex4300-48tdcMatch-

juniperex4300-48tdc-afiMatch-

juniperex4300-mpMatch-

juniperex4300-vcMatch-

juniperex4300_multigigabitMatch-

juniperex4300mMatch-

juniperex4400Match-

juniperex4400-24xMatch-

juniperex4400_multigigabitMatch-

juniperex4500Match-

juniperex4500-vcMatch-

juniperex4550Match-

juniperex4550-vcMatch-

juniperex4550\/vcMatch-

juniperex4600Match-

juniperex4600-vcMatch-

juniperex4650Match-

juniperex6200Match-

juniperex6210Match-

juniperex8200Match-

juniperex8200-vcMatch-

juniperex8208Match-

juniperex8216Match-

juniperex9200Match-

juniperex9204Match-

juniperex9208Match-

juniperex9214Match-

juniperex9250Match-

juniperex9251Match-

juniperex9253Match-

junipersrx100Match-

junipersrx110Match-

junipersrx1400Match-

junipersrx1500Match-

junipersrx1600Match-

junipersrx210Match-

junipersrx220Match-

junipersrx2300Match-

junipersrx240Match-

junipersrx240h2Match-

junipersrx240mMatch-

junipersrx300Match-

junipersrx320Match-

junipersrx340Match-

junipersrx3400Match-

junipersrx345Match-

junipersrx3600Match-

junipersrx380Match-

junipersrx4000Match-

junipersrx4100Match-

junipersrx4200Match-

junipersrx4300Match-

junipersrx4600Match-

junipersrx4700Match-

junipersrx5000Match-

junipersrx5400Match-

junipersrx550Match-

junipersrx550_hmMatch-

junipersrx550mMatch-

junipersrx5600Match-

junipersrx5800Match-

junipersrx650Match-

VendorProductVersionCPE
juniperjunos21.4cpe:/o:juniper:junos:21.4:r3-s2::
juniperjunos22.3cpe:/o:juniper:junos:22.3:r1-s1::
juniperjunos22.1cpe:/o:juniper:junos:22.1:r1-s1::
juniperjunos22.2cpe:/o:juniper:junos:22.2:r2::
juniperjunos22.3cpe:/o:juniper:junos:22.3:r1-s2::
juniperjunos21.4cpe:/o:juniper:junos:21.4:r2::
juniperjunos21.2cpe:/o:juniper:junos:21.2:r3-s6::
juniperjunos21.2cpe:/o:juniper:junos:21.2:r3-s4::
juniperjunos21.2cpe:/o:juniper:junos:21.2:r3-s1::
juniperjunos20.4cpe:/o:juniper:junos:20.4:r3-s7::

Vendor	Product	Version	CPE
juniper	junos	21.4	cpe:/o:juniper:junos:21.4:r3-s2::
juniper	junos	22.3	cpe:/o:juniper:junos:22.3:r1-s1::
juniper	junos	22.1	cpe:/o:juniper:junos:22.1:r1-s1::
juniper	junos	22.2	cpe:/o:juniper:junos:22.2:r2::
juniper	junos	22.3	cpe:/o:juniper:junos:22.3:r1-s2::
juniper	junos	21.4	cpe:/o:juniper:junos:21.4:r2::
juniper	junos	21.2	cpe:/o:juniper:junos:21.2:r3-s6::
juniper	junos	21.2	cpe:/o:juniper:junos:21.2:r3-s4::
juniper	junos	21.2	cpe:/o:juniper:junos:21.2:r3-s1::
juniper	junos	20.4	cpe:/o:juniper:junos:20.4:r3-s7::

Rows per page:

1-10 of 881

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "SRX Series",
      "EX Series"
    ],
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "20.4R3-S10",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "21.2R3-S8",
        "status": "affected",
        "version": "21.2",
        "versionType": "semver"
      },
      {
        "lessThan": "21.4R3-S6",
        "status": "affected",
        "version": "21.4",
        "versionType": "semver"
      },
      {
        "lessThan": "22.1R3-S5",
        "status": "affected",
        "version": "22.1",
        "versionType": "semver"
      },
      {
        "lessThan": "22.2R3-S3",
        "status": "affected",
        "version": "22.2",
        "versionType": "semver"
      },
      {
        "lessThan": "22.3R3-S2",
        "status": "affected",
        "version": "22.3",
        "versionType": "semver"
      },
      {
        "lessThan": "22.4R3-S1",
        "status": "affected",
        "version": "22.4",
        "versionType": "semver"
      },
      {
        "lessThan": "23.2R2",
        "status": "affected",
        "version": "23.2",
        "versionType": "semver"
      },
      {
        "lessThan": "23.4R2",
        "status": "affected",
        "version": "23.4",
        "versionType": "semver"
      }
    ]
  }
]

References

supportportal.juniper.net/JSA76390

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2024-21620

nvd1 prion1 cvelist1 thn1