GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2018-0059

Vulnerability from fkie_nvd - Published: 2018-10-10 18:29 - Updated: 2026-06-17 01:29
Severity
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26.
References
sirt@juniper.nethttps://kb.juniper.net/JSA10894Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://kb.juniper.net/JSA10894Vendor Advisory
Impacted products
Vendor Product Version
juniper netscreen_screenos 6.3.0
juniper netscreen_screenos 6.3.0r1
juniper netscreen_screenos 6.3.0r2
juniper netscreen_screenos 6.3.0r3
juniper netscreen_screenos 6.3.0r4
juniper netscreen_screenos 6.3.0r5
juniper netscreen_screenos 6.3.0r6
juniper netscreen_screenos 6.3.0r7
juniper netscreen_screenos 6.3.0r8
juniper netscreen_screenos 6.3.0r9
juniper netscreen_screenos 6.3.0r10
juniper netscreen_screenos 6.3.0r11
juniper netscreen_screenos 6.3.0r12
juniper netscreen_screenos 6.3.0r13
juniper netscreen_screenos 6.3.0r14
juniper netscreen_screenos 6.3.0r15
juniper netscreen_screenos 6.3.0r16
juniper netscreen_screenos 6.3.0r17
juniper netscreen_screenos 6.3.0r18
juniper netscreen_screenos 6.3.0r19
juniper netscreen_screenos 6.3.0r21
juniper netscreen_screenos 6.3.0r22
juniper netscreen_screenos 6.3.0r23
juniper netscreen_screenos 6.3.0r23b1
juniper netscreen_screenos 6.3.0r24
juniper netscreen_screenos 6.3.0r24b1
juniper netscreen_screenos 6.3.0r25
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ScreenOS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "6.3.0r26",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "96401D48-27DC-430A-A4B4-948E17BA6E39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5A09352-D6E7-4D28-B56B-482EA05CEE17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r2:*:*:*:*:*:*:*",
              "matchCriteriaId": "31866992-A433-492F-8917-C6EAE2DE93A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCC1E507-094A-4E58-860A-13A8358A7B6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r4:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CD02B72-9C50-4DF9-97A6-A54716E1FE56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F3DD43B-6F14-4AE5-8D68-605E6B5DE5A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1D1C538-CACD-45A5-B1C1-2335FDA12E97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r7:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E699028-E9BC-403A-96CB-E16ED464D01B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r8:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FD07648-C22A-4DBF-8B40-CB4A8C3C2102",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r9:*:*:*:*:*:*:*",
              "matchCriteriaId": "1004079D-342C-4EC0-974A-2DE56FC3F700",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r10:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A7D1CD7-5865-41E8-B559-5C6A75A9B62A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r11:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DED0811-87AD-4693-B81A-567904FB8D78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r12:*:*:*:*:*:*:*",
              "matchCriteriaId": "323B99B7-D519-4DA5-A1DE-7A2A226EEACF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE094DA-E949-4338-ACB8-53070BA959C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r14:*:*:*:*:*:*:*",
              "matchCriteriaId": "36F89341-6353-4884-912E-F6FD0A7751A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r15:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CFD2BBD-BBE2-4F53-A0C8-0CBCF7D1B40F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r16:*:*:*:*:*:*:*",
              "matchCriteriaId": "248A6131-813B-4A52-87FC-4F1C7012348C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r17:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB2D7C68-EA5A-4FAA-AE55-A186B65B81BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r18:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EC7AA8A-9876-4B3D-BBFF-FDEEAAFADB6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r19:*:*:*:*:*:*:*",
              "matchCriteriaId": "18AB6421-675E-43AC-A8A9-3839C71BAD46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r21:*:*:*:*:*:*:*",
              "matchCriteriaId": "93C4AD2D-BFB2-476A-917F-D149F280D02F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r22:*:*:*:*:*:*:*",
              "matchCriteriaId": "05A72249-E0FC-4EFF-B81A-BB2A6120681A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r23:*:*:*:*:*:*:*",
              "matchCriteriaId": "324C5CAF-199B-4EAE-A3FB-5C8AF90DDFBA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r23b1:*:*:*:*:*:*:*",
              "matchCriteriaId": "18749046-BC0F-49F0-B89D-723725138D64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r24:*:*:*:*:*:*:*",
              "matchCriteriaId": "67704888-85CA-4C4C-94B5-7D0AA5F6DBC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r24b1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAA3B77C-8213-4847-BA56-4A9BF921016F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:netscreen_screenos:6.3.0r25:*:*:*:*:*:*:*",
              "matchCriteriaId": "25C306B0-F3EF-4A01-A5DA-6386FCE0E59F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad Cross-Site Scripting (XSS) persistente en la interfaz gr\u00e1fica de usuario de ScreenOS podr\u00eda permitir que un usuario autenticado remoto inyecte scripts web o HTML y robe datos sensibles y credenciales de una sesi\u00f3n de administraci\u00f3n web, posiblemente enga\u00f1ando a un usuario administrativo  Las versiones afectadas son Juniper Networks ScreenOS 6.3.0 en versiones anteriores a la 6.3.0r26."
    }
  ],
  "id": "CVE-2018-0059",
  "lastModified": "2026-06-17T01:29:30.790",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "sirt@juniper.net",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-10T18:29:03.250",
  "references": [
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10894"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10894"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.