CVE-2025-59978
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages. When another user views such a page, the attacker can execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.
Risk Assessment
An attacker could hijack an administrator's session and execute arbitrary commands in Junos Space, potentially leading to full compromise of network management.
Recommendation
Update Junos Space to version 24.1R4 or later and implement XSS protections such as Content Security Policy.
Other vulnerabilities in Juniper Networks Junos Space
See all- CVE-2017-10624High
Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.
- CVE-2017-10612High
A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML. This may be used to steal information or perform actions as other Junos Space users or administrators.
Original NVD description (English source)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS