Vulnerability Details : CVE-2017-2306
On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.
Vulnerability category: Execute code
Products affected by CVE-2017-2306
- cpe:2.3:a:juniper:junos_space:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-2306
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 43 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-2306
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-2306
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-2306
-
http://www.securityfocus.com/bid/98772
Juniper Junos Space CVE-2017-2306 Remote Code Execution VulnerabilityThird Party Advisory;VDB Entry
-
https://kb.juniper.net/JSA10770
Juniper Networks - 2017-01 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 16.1R1 release.Mitigation;Vendor Advisory
Jump to