CVE-2017-2335 json
ScreenOS: XSS vulnerability in ScreenOS Firewall
published 2017-07-14 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11518
- cvss
- 8.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 0
- none known
Summary
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
Exploit prediction
1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Juniper Networks ScreenOS
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
kb.juniper.net
/JSA10782
vendor-advisory
-
securitytracker.com
/id/1038881
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/99590
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-2335
- NVD CVE-2017-2335
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.