CVE-2019-0023

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Juniper Networks	Juniper ATP	>= 5.0, < 5.0.3

References

https://kb.juniper.net/JSA10918Patch, Vendor Advisory
https://kb.juniper.net/JSA10918Patch, Vendor Advisory

Timeline

Published: Jan 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-00245.4A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00255.4A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00265.4A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitr CVE-2019-00275.4A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject CVE-2019-00287.5On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a CVE-2019-00297.8Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can ac CVE-2019-00307.2Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue af CVE-2019-00317.5Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using CVE-2019-00327.8A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A loca CVE-2019-00337.5A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leadi CVE-2019-00356.8When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be ch CVE-2019-00369.8When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.)