Junos: vulnerabilities in J-Web (CVE-2016-1261)
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juniper Networks | Junos OS | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Vendor Workaround
Disable J-Web, or limit access to only trusted hosts which may not be compromised by cross-site attacks. For example, deploy jump hosts with no Internet access that use anti-scripting techniques to mitigate potential threats. Alternately, use a dedicated client and dedicated Web browser that is not used to access other sites.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2016-2360 | J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS). |
No CVSS v4.0
No CVSS v3.1
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.382% probability within 30 days)
Key SSVC decision points have not yet been added.
| Link | Providers |
|---|---|
| https://kb.juniper.net/JSA10723 |
|
No history.