CVE Feed

    Dashboard / CVE / CVE-2017-2338

    CVE-2017-2338

    A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.

    Published:Jul 14, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 14, 2017
    EPSS Score:0.00208
    CVSS Score:8.4

    Affected Products

    Vendor
    Juniper
    Product
    Screenos

    Exploits

    No exploit reference

    Related CVEs

    CVE-2018-0014 (CVSS 4.3) — Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fr…
    CVE-2017-2337 (CVSS 8.4) — A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firew…
    CVE-2017-2335 (CVSS 8.4) — A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firew…
    CVE-2017-2339 (CVSS 8.4) — A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firew…
    CVE-2017-2336 (CVSS 9.6) — A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewa…
    CVE-2016-1268 (CVSS 7.5) — The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause…
    CVE-2015-7754 (CVSS 8.1) — Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a d…
    CVE-2015-7756 (CVSS 5) — The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r…
    CVE-2015-7755 (CVSS 9.8) — Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 bef…
    CVE-2015-7750 (CVSS 5) — The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS bef…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High