CVSS: v3.1: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)CVSS: v4.0: 7.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/AU:Y/R:A/V:C/RE:M/U:Green)
Multiple vulnerabilities have been resolved in Junos Space Security Director 24.1R4 release.These issues affect all versions of Juniper Networks Security Director before 24.1R4.
Important security issues resolved include:
8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Amber
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space Security Director allows an attacker to inject malicious scripts into the application, which are then stored and executed in the context of other users' browsers when they access affected pages.
Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.
These issues were seen during production usage.
The following software releases have been updated to resolve these specific issues: Junos Space Security Director: 24.1R4, and all subsequent releases.
This issue is being tracked as 1829067 which is visible on the Customer Support website.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
There are no known workarounds for these issues.To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.
2025-10-08: Initial Publication2025-10-08: Corrected copy/paste typo in Solution field