CVE-2018-0011

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Juniper Networks	Junos Space	>= All, < 17.2R1

References

http://www.securitytracker.com/id/1040189Third Party Advisory, VDB Entry
https://kb.juniper.net/JSA10838Patch, Vendor Advisory
http://www.securitytracker.com/id/1040189Third Party Advisory, VDB Entry
https://kb.juniper.net/JSA10838Patch, Vendor Advisory

Timeline

Published: Jan 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-00127.8Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.CVE-2018-00136.5A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve CVE-2018-00146.5Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or da CVE-2018-00157.5A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and CVE-2018-00167.5Receipt of a specially crafted Connectionless Network Protocol (CLNP) datagram destined to an interface of a Junos OS device may result in a CVE-2018-00176.5A vulnerability in the Network Address Translation - Protocol Translation (NAT-PT) feature of Junos OS on SRX series devices may allow a cer CVE-2018-00185.9On SRX Series devices during compilation of IDP policies, an attacker sending specially crafted packets may be able to bypass firewall rules CVE-2018-00195.9A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to cras CVE-2018-00207.5Junos OS may be impacted by the receipt of a malformed BGP UPDATE which can lead to a routing process daemon (rpd) crash and restart. Receip CVE-2018-00218.8If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not confi CVE-2018-00227.5A Junos device with VPLS routing-instances configured on one or more interfaces may be susceptible to an mbuf leak when processing a specifi CVE-2018-00235.5JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configura