CVE-2013-4689

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators for requests that (1) create new administrator accounts or (2) have other unspecified impacts.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10597Vendor Advisory
http://osvdb.org/98325
http://secunia.com/advisories/55166Vendor Advisory
http://www.securityfocus.com/bid/62940
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10597Vendor Advisory
http://osvdb.org/98325
http://secunia.com/advisories/55166Vendor Advisory
http://www.securityfocus.com/bid/62940

Timeline

Published: Oct 17, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-46905.0Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 CVE-2013-46916.1Sencha Labs Connect has XSS with connect.methodOverride()CVE-2013-46926.1Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS CVE-2013-46936.1WordPress Xorbin Digital Flash Clock 1.0 has XSS CVE-2013-46947.5Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) CVE-2013-46957.8Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution CVE-2013-46979.0Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 th CVE-2013-46983.5Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in oppor CVE-2013-46995.8The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allow CVE-2013-47005.8The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-t CVE-2013-47017.5Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet s CVE-2013-47025.0Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 thr