Product:
Junos Space
Summary
An Improper Neutralization of Input During Web Page Generation vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages. When these pages are visited by another user, the attacker can execute commands with the target’s permissions, including those of an administrator. This issue affects all versions of Junos Space before 24.1R4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-59990 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious template that includes script tags. Once the template is created, the attacker needs to convince another user to visit the affected page. Upon visiting, the injected script will execute in the context of the victim’s session, allowing the attacker to perform actions with the victim’s permissions.
Affected Products
- Junos Space: All versions before 24.1R4 are affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to Junos Space version 24.1R4 or later. Additionally, implementing input validation and sanitization measures can help prevent script injection attacks in web applications.