Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-3485 — Cross-site Scripting in Juniper Junos

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

4.3MEDIUMNVD

EPSS

1.9%

top 16.75%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Juniper Junos Juniper J-web Juniper Junos OS

Timeline

PublishedSep 30

Latest updateMay 2

Description

Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDjuniper/junos8.5, 9.0+1

▶juniperjuniper/junos_os

▶juniperjuniper/j-web

🔴Vulnerability Details

GHSA

GHSA-w6gf-8h7h-2hmw: Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8↗2022-05-02

▶

💥Exploits & PoCs

Exploit-DB

Juniper Junos 8.5/9.0 J - Web Interface 'PATH_INFO' Cross-Site Scripting↗2009-09-22

▶

📋Vendor Advisories

Juniper

CVE-2009-3485: Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web↗2009-09-30

▶