CVE-2017-2336

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Juniper Networks	ScreenOS	6.3.0 prior to 6.3.0r24

References

http://www.securityfocus.com/bid/99590Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038881Third Party Advisory, VDB Entry
https://kb.juniper.net/JSA10782Vendor Advisory
http://www.securityfocus.com/bid/99590Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038881Third Party Advisory, VDB Entry
https://kb.juniper.net/JSA10782Vendor Advisory

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-23375.4A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allow CVE-2017-23385.4A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allow CVE-2017-23395.4A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allow CVE-2017-23405.3On Juniper Networks Junos OS 15.1 releases from 15.1R3 to 15.1R4, 16.1 prior to 16.1R3, on M/MX platforms where Enhanced Subscriber Manageme CVE-2017-23418.8An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivile CVE-2017-23428.1MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not CVE-2017-23439.8The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide si CVE-2017-23447.8A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a CVE-2017-23459.8On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to cras CVE-2017-23465.9An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated cras CVE-2017-23477.5A denial of service vulnerability in rpd daemon of Juniper Networks Junos OS allows a malformed MPLS ping packet to crash the rpd daemon if CVE-2017-23487.5The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Bot