CVE-2022-22242

Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web

Published Oct 18, 2022 CVSS 3.1 · 6.1 Medium EPSS 3.4% KEV · Not listed
Description
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS 19.1R3-S9, 19.2R3-S6. 19.3R3-S7, 19.4R3-S9, 20.1R3-S5, 20.2R3-S5, 20.3R3-S5, 20.4R3-S4, 21.1R3-S4, 21.2R3-S1, 21.3R3, 21.4R2, 21.4R3, 22.1R2, 22.2R1, and all subsequent releases.


Vendor Workaround

Disable J-Web, or limit access to only trusted hosts.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
History
Type Values Removed Values Added
Metrics epss

{'score': 0.87403}

epss

{'score': 0.85707}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
juniper
Published
Updated
May 9, 2025, 3:36 PM
Reserved
Dec 21, 2021, 12:00 AM
Status
Modified
Published
Oct 18, 2022, 3:15 AM
Modified
Jun 17, 2026, 4:28 AM