Juniper Junos SRX Series CVE-2015-3005 Cross Site Scripting Vulnerability

Bugtraq ID:	74016
Class:	Input Validation Error
CVE:	CVE-2015-3005
Remote:	Yes
Local:	No
Published:	Apr 09 2015 12:00AM
Updated:	Apr 09 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Juniper Junos OS 12.1X46-D25 Juniper Junos OS 12.1X46-D20 Juniper Junos 12.1X47-D15 Juniper Junos 12.1X47-D11 Juniper Junos 12.1X47-D10 Juniper JUNOS 12.1X47 D10 Juniper JUNOS 12.1X46-D25 Juniper Junos 12.1X46-D20.5 Juniper Junos 12.1X46-D20 Juniper Junos 12.1X46-D15 Juniper Junos 12.1X46-D10 Juniper Junos 12.1X46 D25 Juniper JUNOS 12.1X46 D20 Juniper JUNOS 12.1X46 D15 Juniper Junos 12.1X46 D10 Juniper JUNOS 12.1X46 -D10 Juniper Junos 12.1X45-D20 Juniper Junos 12.1X45-D10 Juniper JUNOS 12.1X44-D40 Juniper Junos 12.1X44-D35 Juniper Junos 12.1X44-D34 Juniper Junos 12.1X44-D32 Juniper Junos 12.1X44-D30.4 Juniper Junos 12.1X44-D30 Juniper Junos 12.1X44-D26 Juniper JUNOS 12.1X44-D25 Juniper Junos 12.1X44-D20.3 Juniper Junos 12.1X44-D20 Juniper JUNOS 12.1X44-D20 Juniper JUNOS 12.1X44-D15 Juniper JUNOS 12.1X44 D40 Juniper JUNOS 12.1X44 D35 Juniper Junos 12.1X44 D30 Juniper JUNOS 12.1X44 D25 Juniper Junos 12.1X44 D20 Juniper JUNOS 12.1X44 D15 Juniper Junos 12.1X44 D10
Not Vulnerable:	Juniper Junos 12.3X48-D10 Juniper Junos 12.1X47-D20 Juniper Junos 12.1X46-D30 Juniper Junos 12.1X44-D45

Juniper Junos SRX Series CVE-2015-3005 Cross Site Scripting Vulnerability

Juniper Junos is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Juniper Junos SRX Series CVE-2015-3005 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Juniper Junos SRX Series CVE-2015-3005 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Juniper Junos SRX Series CVE-2015-3005 Cross Site Scripting Vulnerability

References:

• 2014-07 Security Bulletin: Junos: XSS vulnerability in web authentication (webau (Juniper Networks)
  
• Juniper Networks Homepage (Juniper Networks)