"value":"A persistent cross-site scripting (XSS) vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device.\n\nThis issue affects Juniper Networks Junos OS:\nAll versions, including the following supported releases:\n12.3X48 versions prior to 12.3X48-D105;\n15.1X49 versions prior to 15.1X49-D220;\n18.3 versions prior to 18.3R3-S5;\n18.4 versions prior to 18.4R3-S9;\n19.1 versions prior to 19.1R3-S7;\n19.2 versions prior to 19.2R3-S3;\n19.3 versions prior to 19.3R3-S4;\n19.4 versions prior to 19.4R3-S6;\n20.1 versions prior to 20.1R3;\n20.2 versions prior to 20.2R1-S1, 20.2R2;\n20.3 versions prior to 20.3R2;\n20.4 versions prior to 20.4R2;\n21.1 versions prior to 21.1R2."
"value":"The following software releases have been updated to resolve this specific issue: Junos OS 12.3X48-D105, 15.1X49-D220, 18.3R3-S5, 18.4R3-S9, 19.1R3-S7, 19.2R3-S3, 19.3R3-S4, 19.4R3-S6, 20.1R3, 20.2R1-S1, 20.2R2, 20.3R2, 20.4R2, 21.1R2, 21.2R1 and all subsequent releases.\n\nAdditionally, after performing an upgrade to a resolved release, additional steps must be taken to ensure that all stored malicious scripts are removed from the configuration."
}
],
"source":{
"advisory":"JSA11220",
"defect":[
"1449280"
],
"discovery":"EXTERNAL"
},
"work_around":[
{
"lang":"eng",
"value":"There are no viable workarounds for this issue."