5.1

CVE-2013-4689

J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators for requests that (1) create new administrator accounts or (2) have other unspecified impacts.

Data is provided by the National Vulnerability Database (NVD)
Juniper ≫ Junos Version <= 10.4
Juniper ≫ Junos Version4.0
Juniper ≫ Junos Version4.1
Juniper ≫ Junos Version4.2
Juniper ≫ Junos Version4.3
Juniper ≫ Junos Version4.4
Juniper ≫ Junos Version5.0
Juniper ≫ Junos Version5.1
Juniper ≫ Junos Version5.2
Juniper ≫ Junos Version5.3
Juniper ≫ Junos Version5.4
Juniper ≫ Junos Version5.5
Juniper ≫ Junos Version5.6
Juniper ≫ Junos Version5.7
Juniper ≫ Junos Version6.0
Juniper ≫ Junos Version6.1
Juniper ≫ Junos Version6.2
Juniper ≫ Junos Version6.3
Juniper ≫ Junos Version6.4
Juniper ≫ Junos Version7.0
Juniper ≫ Junos Version7.1
Juniper ≫ Junos Version7.2
Juniper ≫ Junos Version7.3
Juniper ≫ Junos Version7.4
Juniper ≫ Junos Version7.5
Juniper ≫ Junos Version7.6
Juniper ≫ Junos Version8.0
Juniper ≫ Junos Version8.1
Juniper ≫ Junos Version8.2
Juniper ≫ Junos Version8.3
Juniper ≫ Junos Version8.4
Juniper ≫ Junos Version9.0
Juniper ≫ Junos Version9.1
Juniper ≫ Junos Version9.2
Juniper ≫ Junos Version9.4
Juniper ≫ Junos Version9.5
Juniper ≫ Junos Version9.6
Juniper ≫ Junos Version11.4
Juniper ≫ Junos Version12.1
Juniper ≫ Junos Version12.1x44
Juniper ≫ Junos Version12.1x45
Juniper ≫ Junos Version12.2
Juniper ≫ Junos Version12.3
Juniper ≫ Junos Version13.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.23
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.