CVE-2014-6447 Cross-site scripting in n/a

High 7.1 Published 11 Feb 2020 Updated 6 Aug 2024

Attackers can inject malicious scripts into Juniper Junos J-Web interfaces, potentially stealing user data or crashing the web service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2014-6447?

CVE-2014-6447 is a high-severity cross-site scripting vulnerability in Juniper Junos, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1.

Weakness: CWE-79

Which versions are affected by CVE-2014-6447?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2014-6447?

No fix has been published for CVE-2014-6447 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2014-6447 being exploited?

There is no known exploitation of CVE-2014-6447 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-wh9q-c9r7-2w74.