Read the docs
TI-2017-01617 Aliases CVE-2017-2336GHSA-qgvx-4g6f-j5mh

ScreenOS: XSS vulnerability in ScreenOS Firewall

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.

Why it matters now

EPSS 0.01194 68th percentileScored 2026-11-07
Fix Fixed ScreenOS (Juniper Networks): 6.3.0r24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperScreenOS6.3.0 to before 6.3.0r246.3.0r24Patch availableCNA
  • ScreenOS VendorJuniper Affected 6.3.0 to before 6.3.0r24 Fixed in 6.3.0r24 Patch available CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:juniper:screenos:6.3.0:*:*:*:*:*:*:*6.3.0VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r1:*:*:*:*:*:*6.3.0 r1VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r10:*:*:*:*:*:*6.3.0 r10VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r11:*:*:*:*:*:*6.3.0 r11VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:*6.3.0 r12VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r13:*:*:*:*:*:*6.3.0 r13VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:*6.3.0 r14VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:*6.3.0 r15VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:*6.3.0 r16VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*6.3.0 r17VulnerableJuniper
  • cpe:2.3:o:juniper:screenos:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r1:*:*:*:*:*:* Versions 6.3.0 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r10:*:*:*:*:*:* Versions 6.3.0 r10 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r11:*:*:*:*:*:* Versions 6.3.0 r11 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:* Versions 6.3.0 r12 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r13:*:*:*:*:*:* Versions 6.3.0 r13 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:* Versions 6.3.0 r14 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:* Versions 6.3.0 r15 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:* Versions 6.3.0 r16 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:* Versions 6.3.0 r17 Vulnerable ·Juniper
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*6.3.0 r18VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*6.3.0 r19VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r2:*:*:*:*:*:*6.3.0 r2VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r21:*:*:*:*:*:*6.3.0 r21VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r22:*:*:*:*:*:*6.3.0 r22VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r23:*:*:*:*:*:*6.3.0 r23VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r23b:*:*:*:*:*:*6.3.0 r23bVulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r3:*:*:*:*:*:*6.3.0 r3VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r4:*:*:*:*:*:*6.3.0 r4VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r5:*:*:*:*:*:*6.3.0 r5VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r6:*:*:*:*:*:*6.3.0 r6VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r7:*:*:*:*:*:*6.3.0 r7VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r8:*:*:*:*:*:*6.3.0 r8VulnerableJuniper
cpe:2.3:o:juniper:screenos:6.3.0:r9:*:*:*:*:*:*6.3.0 r9VulnerableJuniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:* Versions 6.3.0 r18 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:* Versions 6.3.0 r19 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r2:*:*:*:*:*:* Versions 6.3.0 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r21:*:*:*:*:*:* Versions 6.3.0 r21 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r22:*:*:*:*:*:* Versions 6.3.0 r22 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r23:*:*:*:*:*:* Versions 6.3.0 r23 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r23b:*:*:*:*:*:* Versions 6.3.0 r23b Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r3:*:*:*:*:*:* Versions 6.3.0 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r4:*:*:*:*:*:* Versions 6.3.0 r4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r5:*:*:*:*:*:* Versions 6.3.0 r5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r6:*:*:*:*:*:* Versions 6.3.0 r6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r7:*:*:*:*:*:* Versions 6.3.0 r7 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r8:*:*:*:*:*:* Versions 6.3.0 r8 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:screenos:6.3.0:r9:*:*:*:*:*:* Versions 6.3.0 r9 Vulnerable ·Juniper

Remediation

  • Fix · CNA ScreenOS (Juniper Networks) Fixed in 6.3.0r24

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2336
  2. 2026-10-03 Alias added: GHSA-qgvx-4g6f-j5mh

References

Advisory 1

  • TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-06435 Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote… CVSS 3.0HIGH 8.1
  • TI-2014-02278 Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service… CVSS 2.0HIGH 7.8
  • TI-2017-01620 ScreenOS: XSS vulnerability in ScreenOS Firewall CVSS 3.0HIGH 8.4
  • TI-2017-01619 ScreenOS: XSS vulnerability in ScreenOS Firewall CVSS 3.0HIGH 8.4
  • TI-2017-01618 ScreenOS: XSS vulnerability in ScreenOS Firewall CVSS 3.0HIGH 8.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences