Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Junos Space Global Search Allows Malicious Script Injection

CVE-2025-59984 · published 1 year ago
Summary

A security issue in Junos Space allows an attacker to inject malicious code into the Global Search feature, which can be executed when another user visits the search results. This could potentially allow an attacker to take control of an administrator's account. Junos Space users should update to version 24.1R4 or later to fix this issue.

What to do
  • Update juniper junos_space to version 24.1 or later.
Affected software
VendorProductAffected versions
juniper junos_space < 24.1
24.1
cpe:2.3:a:juniper:junos_space:*:*:*:*:*:*:*:*
Original advisory text
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that,...
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-59984 · NVD
Track software like this
Free during beta