CVE-2017-2308 XML external entity in Junos Space

What is CVE-2017-2308?

CVE-2017-2308 is a medium-severity vulnerability in Juniper Junos Space, published on 30 May 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.

Weakness: CWE-611

Which versions are affected by CVE-2017-2308?

It affects 1 product.

Products include Juniper Junos Space.

How do I fix CVE-2017-2308?

No fix has been published for CVE-2017-2308 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-2308 being exploited?

There is no known exploitation of CVE-2017-2308 in the wild and no public exploit code.

Other vulnerabilities in Juniper Junos Space

• CVE-2014-3412 Command injection in n/a Critical 10.0
• CVE-2014-3413 Hardcoded credentials in n/a Critical 9.8
• CVE-2016-1265 Junos Space: privilege escalation vulnerabilities in Junos Space Critical 9.8
• CVE-2017-10622 Junos Space: Authentication bypass vulnerability Critical 9.8
• CVE-2016-4926 Auth bypass in n/a Critical 9.8

All Juniper Junos Space vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8288-c5xc-3655.