6.1

CVE-2026-21904

Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the 

list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.

This issue affects all versions of Junos Space before 24.1R5 Patch V3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Space Version 1.0
Juniper ≫ Junos Space Version 1.1
Juniper ≫ Junos Space Version 1.2
Juniper ≫ Junos Space Version 1.3
Juniper ≫ Junos Space Version 1.4
Juniper ≫ Junos Space Version 2.0
Juniper ≫ Junos Space Version 11.1
Juniper ≫ Junos Space Version 11.2
Juniper ≫ Junos Space Version 11.3
Juniper ≫ Junos Space Version 11.4
Juniper ≫ Junos Space Version 12.1
Juniper ≫ Junos Space Version 12.2
Juniper ≫ Junos Space Version 12.3
Juniper ≫ Junos Space Version 13.1 Update -
Juniper ≫ Junos Space Version 13.1 Update r1.8
Juniper ≫ Junos Space Version 13.3 Update r1
Juniper ≫ Junos Space Version 13.3 Update r1.1
Juniper ≫ Junos Space Version 13.3 Update r1.2
Juniper ≫ Junos Space Version 13.3 Update r1.3
Juniper ≫ Junos Space Version 13.3 Update r1.4
Juniper ≫ Junos Space Version 13.3 Update r1.5
Juniper ≫ Junos Space Version 13.3 Update r1.6
Juniper ≫ Junos Space Version 13.3 Update r1.7
Juniper ≫ Junos Space Version 13.3 Update r1.8
Juniper ≫ Junos Space Version 13.3 Update r1.9
Juniper ≫ Junos Space Version 13.3 Update r2
Juniper ≫ Junos Space Version 13.3 Update r3
Juniper ≫ Junos Space Version 13.3 Update r4
Juniper ≫ Junos Space Version 14.1 Update -
Juniper ≫ Junos Space Version 14.1 Update r1
Juniper ≫ Junos Space Version 14.1 Update r2
Juniper ≫ Junos Space Version 14.1 Update r3
Juniper ≫ Junos Space Version 15.1 Update -
Juniper ≫ Junos Space Version 15.1 Update r2
Juniper ≫ Junos Space Version 15.1 Update r3
Juniper ≫ Junos Space Version 15.1 Update r4
Juniper ≫ Junos Space Version 15.2 Update -
Juniper ≫ Junos Space Version 15.2 Update r2
Juniper ≫ Junos Space Version 16.1
Juniper ≫ Junos Space Version 16.1 Update -
Juniper ≫ Junos Space Version 16.1 Update r1
Juniper ≫ Junos Space Version 16.1 Update r2
Juniper ≫ Junos Space Version 16.1 Update r3
Juniper ≫ Junos Space Version 16.1r3
Juniper ≫ Junos Space Version 17.1 Update -
Juniper ≫ Junos Space Version 17.1 Update r1
Juniper ≫ Junos Space Version 17.2 Update -
Juniper ≫ Junos Space Version 17.2 Update r1.4
Juniper ≫ Junos Space Version 18.1 Update -
Juniper ≫ Junos Space Version 18.1r1
Juniper ≫ Junos Space Version 18.2 Update -
Juniper ≫ Junos Space Version 18.3 Update -
Juniper ≫ Junos Space Version 18.4 Update -
Juniper ≫ Junos Space Version 19.1 Update -
Juniper ≫ Junos Space Version 20.3 Update r1
Juniper ≫ Junos Space Version 21.1 Update r1
Juniper ≫ Junos Space Version 21.2 Update r1
Juniper ≫ Junos Space Version 21.3 Update r1
Juniper ≫ Junos Space Version 22.1 Update r1
Juniper ≫ Junos Space Version 22.2 Update r1
Juniper ≫ Junos Space Version 22.3 Update r1
Juniper ≫ Junos Space Version 23.1 Update r1
Juniper ≫ Junos Space Version 24.1 Update r1
Juniper ≫ Junos Space Version 24.1 Update r2
Juniper ≫ Junos Space Version 24.1 Update r3
Juniper ≫ Junos Space Version 24.1 Update r4
Juniper ≫ Junos Space Version 24.1 Update r5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.111
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Juniper 5.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Juniper 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://kb.juniper.net/JSA106003
Vendor Advisory