CVE-2017-2338 Details
Description
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.juniper.net/JSA10782 | CVE | Vendor Advisory |
| http://www.securityfocus.com/bid/99590 | CVE | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038881 | CVE | Third Party AdvisoryVDB Entry |
| https://kb.juniper.net/JSA10782 | [email protected] | Vendor Advisory |
| http://www.securityfocus.com/bid/99590 | [email protected] | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038881 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| juniper screenos | 6.3.0 6.3.0 r1 6.3.0 r10 6.3.0 r11 6.3.0 r12 6.3.0 r13 6.3.0 r14 6.3.0 r15 6.3.0 r16 6.3.0 r17 6.3.0 r18 6.3.0 r19 6.3.0 r2 6.3.0 r21 6.3.0 r22 6.3.0 r23 6.3.0 r23b 6.3.0 r3 6.3.0 r4 6.3.0 r5 6.3.0 r6 6.3.0 r7 6.3.0 r8 6.3.0 r9 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 13, 2026 | CVE Status Change | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Oct 9, 2019 | CVE Modified | [email protected] |
| Jul 22, 2017 | CVE Modified | [email protected] |
| Jul 21, 2017 | Initial Analysis | [email protected] |
| Jul 18, 2017 | CVE Modified | [email protected] |
| Jul 17, 2017 | CVE Modified | [email protected] |