Sign-up

ID

VAR-202002-0776


CVE

CVE-2014-6447


TITLE

Juniper Junos OS Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2014-008930

DESCRIPTION

Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. Juniper Junos OS Exists in a cross-site scripting vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Juniper Junos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Juniper Networks Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware equipment. The operating system provides a secure programming interface and Junos SDK. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code. The following products and versions are affected: Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D45, 12.1X46 prior to 12.1X46-D30, 12.1X47 prior to 12.1X47-D20, 12.3 prior to 12.3R8, 12.3X48 - 12.3X48 before D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2R1 before 14.2 version, 15.1 version before 15.1R1

Trust: 1.98

sources: NVD: CVE-2014-6447 // JVNDB: JVNDB-2014-008930 // BID: 75717 // VULHUB: VHN-74391

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:12.1x47

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:12.1x46

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:12.1x44

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:13.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:13.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:13.3

Trust: 1.0

vendor:junipermodel:junos osscope:eqversion:12.1x44-d45

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.1x46-d30

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.1x47-d20

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.3r8

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.3x48-d10

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:13.1r5

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:13.2r6

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:13.3r4

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:14.1r3

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:14.1x53-d10

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:14.2r1

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:15.1r1

Trust: 0.8

vendor:junipermodel:junos 14.1r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 14.1r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r1.7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2r5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2r4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.1r4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.1r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.1r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.1r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d11scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos d10scope:eqversion:12.1x47

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d25scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos d25scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos d20scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos d15scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos d10scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos -d10scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d40scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d35scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d34scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d32scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d30.4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d30scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d26scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d25scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d20.3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos d40scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d35scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d30scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d25scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d20scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d15scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos d10scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos 15.1r1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.2r1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 13.3r4scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 13.2r6scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 13.1r5scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d10scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3r8scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d20scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d30scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d45scope:neversion: -

Trust: 0.3

sources: BID: 75717 // JVNDB: JVNDB-2014-008930 // NVD: CVE-2014-6447

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-6447
value: HIGH

Trust: 1.0

NVD: JVNDB-2014-008930
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201507-681
value: HIGH

Trust: 0.6

VULHUB: VHN-74391
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-6447
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2014-008930
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-74391
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2014-6447
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2014-008930
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-74391 // JVNDB: JVNDB-2014-008930 // CNNVD: CNNVD-201507-681 // NVD: CVE-2014-6447

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-74391 // JVNDB: JVNDB-2014-008930 // NVD: CVE-2014-6447

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-681

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201507-681

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-008930

PATCH
title:JSA10682url:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10682
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-008930

EXTERNAL IDS
db:NVDid:CVE-2014-6447
Trust: 2.8
db:SECTRACKid:1032846
Trust: 2.5
db:JUNIPERid:JSA10682
Trust: 2.0
db:JVNDBid:JVNDB-2014-008930
Trust: 0.8
db:CNNVDid:CNNVD-201507-681
Trust: 0.7
db:BIDid:75717
Trust: 0.4
db:VULHUBid:VHN-74391
Trust: 0.1
sources:
            
            
            VULHUB: VHN-74391 // 
            
            
            
            BID: 75717 // 
            
            
            
            JVNDB: JVNDB-2014-008930 // 
            
            
            
            CNNVD: CNNVD-201507-681 // 
            
            
            
            NVD: CVE-2014-6447

REFERENCES
url:http://www.securitytracker.com/id/1032846
Trust: 2.5
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10682
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2014-6447
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6447
Trust: 0.8
url:http://www.juniper.net/
Trust: 0.3
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10682&cat=sirt_1&actp=list
Trust: 0.3
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10682
Trust: 0.1
sources:
            
            
            VULHUB: VHN-74391 // 
            
            
            
            BID: 75717 // 
            
            
            
            JVNDB: JVNDB-2014-008930 // 
            
            
            
            CNNVD: CNNVD-201507-681 // 
            
            
            
            NVD: CVE-2014-6447

CREDITS
Kyle Lovett
Trust: 0.9
sources:
            
            
            BID: 75717 // 
            
            
            
            CNNVD: CNNVD-201507-681

SOURCES
db:VULHUBid:VHN-74391
db:BIDid:75717
db:JVNDBid:JVNDB-2014-008930
db:CNNVDid:CNNVD-201507-681
db:NVDid:CVE-2014-6447

LAST UPDATE DATE
2024-11-23T22:05:48.061000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-74391date:2020-02-25T00:00:00
db:BIDid:75717date:2015-07-13T00:00:00
db:JVNDBid:JVNDB-2014-008930date:2020-03-09T00:00:00
db:CNNVDid:CNNVD-201507-681date:2020-02-26T00:00:00
db:NVDid:CVE-2014-6447date:2024-11-21T02:14:24.100

SOURCES RELEASE DATE
db:VULHUBid:VHN-74391date:2020-02-11T00:00:00
db:BIDid:75717date:2015-07-13T00:00:00
db:JVNDBid:JVNDB-2014-008930date:2020-03-09T00:00:00
db:CNNVDid:CNNVD-201507-681date:2015-07-21T00:00:00
db:NVDid:CVE-2014-6447date:2020-02-11T17:15:11.703