Product:
Junos Space
Summary
An Improper Neutralization of Input During Web Page Generation vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages. When viewed by another user, this enables the attacker to execute commands with the target’s administrative permissions. This issue affects all versions of Junos Space before 24.1R4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.4 | CVE-2025-59978 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious script and store it in a web page within Junos Space. When another user accesses the compromised page, the script executes in their browser, allowing the attacker to perform actions with the user’s administrative privileges. This requires the attacker to have access to the web interface of Junos Space and the ability to inject scripts.
Affected Products
- Junos Space: All versions before 24.1R4 are affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to Junos Space version 24.1R4 or later. Additionally, implementing strict input validation and sanitization measures can help prevent script injection attacks. Regular security audits and monitoring of web applications can also reduce the risk of exploitation.