Details of VAR-201703-0040

ID

VAR-201703-0040

CVE

CVE-2016-4928

TITLE

Junos Space Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2016-008030

DESCRIPTION

Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. Juniper Junos Space is prone to the following multiple security issues: 1. Cross-site scripting vulnerability 2. Cross-site request-forgery vulnerability 3. Authentication-bypass vulnerability 4. An XML external entity injection vulnerability 5. A command-injection vulnerability 6. A security-bypass vulnerability An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, perform certain administrative actions, gain unauthorized access, bypass certain security restrictions or cause denial-of-service conditions. Juniper Networks Junos Space is a set of network management solutions of Juniper Networks (Juniper Networks). The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle

Trust: 1.98

sources: NVD: CVE-2016-4928 // JVNDB: JVNDB-2016-008030 // BID: 93540 // VULHUB: VHN-93747

AFFECTED PRODUCTS

vendor:	juniper	model:	junos space	scope:	lte	version:	15.2	Trust: 1.0
vendor:	juniper	model:	junos space	scope:	eq	version:	15.2	Trust: 0.9
vendor:	juniper	model:	junos space	scope:	lt	version:	15.2r2	Trust: 0.8
vendor:	juniper	model:	junos space 15.2r1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos space 15.2r2	scope:	ne	version:	-	Trust: 0.3

sources: BID: 93540 // JVNDB: JVNDB-2016-008030 // CNNVD: CNNVD-201610-463 // NVD: CVE-2016-4928

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-4928
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-4928
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201610-463
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-93747
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-4928
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-93747
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-4928
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-93747 // JVNDB: JVNDB-2016-008030 // CNNVD: CNNVD-201610-463 // NVD: CVE-2016-4928

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-93747 // JVNDB: JVNDB-2016-008030 // NVD: CVE-2016-4928

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-463

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201610-463

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008030

PATCH

title:	JSA10760	url:	https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10760	Trust: 0.8
title:	Juniper Junos Space Fixes for cross-site request forgery vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64834	Trust: 0.6

sources: JVNDB: JVNDB-2016-008030 // CNNVD: CNNVD-201610-463

EXTERNAL IDS

db:	NVD	id:	CVE-2016-4928	Trust: 2.8
db:	BID	id:	93540	Trust: 2.0
db:	JUNIPER	id:	JSA10760	Trust: 2.0
db:	JVNDB	id:	JVNDB-2016-008030	Trust: 0.8
db:	CNNVD	id:	CNNVD-201610-463	Trust: 0.7
db:	VULHUB	id:	VHN-93747	Trust: 0.1

sources: VULHUB: VHN-93747 // BID: 93540 // JVNDB: JVNDB-2016-008030 // CNNVD: CNNVD-201610-463 // NVD: CVE-2016-4928

REFERENCES

url:	http://www.securityfocus.com/bid/93540	Trust: 1.7
url:	https://kb.juniper.net/infocenter/index?page=content&id=jsa10760	Trust: 1.6
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4928	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2016-4928	Trust: 0.8
url:	http://www.juniper.net/	Trust: 0.3
url:	http://www.juniper.net/au/en/products-services/software/junos-platform/junos-space/	Trust: 0.3
url:	https://kb.juniper.net/infocenter/index?page=content&id=jsa10760&cat=sirt_1&actp=list	Trust: 0.3
url:	https://kb.juniper.net/infocenter/index?page=content&id=jsa10760	Trust: 0.1

sources: VULHUB: VHN-93747 // BID: 93540 // JVNDB: JVNDB-2016-008030 // CNNVD: CNNVD-201610-463 // NVD: CVE-2016-4928

CREDITS

The vendor reported the issue.

Trust: 0.3

sources: BID: 93540

SOURCES

db:	VULHUB	id:	VHN-93747
db:	BID	id:	93540
db:	JVNDB	id:	JVNDB-2016-008030
db:	CNNVD	id:	CNNVD-201610-463
db:	NVD	id:	CVE-2016-4928

LAST UPDATE DATE

2024-11-23T22:07:37.746000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-93747	date:	2017-03-22T00:00:00
db:	BID	id:	93540	date:	2016-10-26T02:07:00
db:	JVNDB	id:	JVNDB-2016-008030	date:	2017-04-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-463	date:	2017-03-21T00:00:00
db:	NVD	id:	CVE-2016-4928	date:	2024-11-21T02:53:15.263

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-93747	date:	2017-03-20T00:00:00
db:	BID	id:	93540	date:	2016-10-12T00:00:00
db:	JVNDB	id:	JVNDB-2016-008030	date:	2017-04-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-463	date:	2016-10-18T00:00:00
db:	NVD	id:	CVE-2016-4928	date:	2017-03-20T20:59:00.220