CVE-2026-21904

Published: Apr 9, 2026Modified: Jul 8, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: sirt@juniper.net (Secondary)

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3.

Affected (67)

Products: Juniper: Junos Space

Juniper

1 product

Junos Space

Configuration A

67 vulnerable

Vulnerable Software	Affected Versions
Juniper Junos Space	Version 1.0
Juniper Junos Space	Version 1.1
Juniper Junos Space	Version 1.2
Juniper Junos Space	Version 1.3
Juniper Junos Space	Version 1.4
Juniper Junos Space	Version 11.1
Juniper Junos Space	Version 11.2
Juniper Junos Space	Version 11.3
Juniper Junos Space	Version 11.4
Juniper Junos Space	Version 12.1
Juniper Junos Space	Version 12.2
Juniper Junos Space	Version 12.3
Juniper Junos Space	Version 13.1
Juniper Junos Space	Version 13.1 r1.8
Juniper Junos Space	Version 13.3 r1.1
Juniper Junos Space	Version 13.3 r1.2
Juniper Junos Space	Version 13.3 r1.3
Juniper Junos Space	Version 13.3 r1.4
Juniper Junos Space	Version 13.3 r1.5
Juniper Junos Space	Version 13.3 r1.6
Juniper Junos Space	Version 13.3 r1.7
Juniper Junos Space	Version 13.3 r1.8
Juniper Junos Space	Version 13.3 r1.9
Juniper Junos Space	Version 13.3 r1
Juniper Junos Space	Version 13.3 r2
Juniper Junos Space	Version 13.3 r3
Juniper Junos Space	Version 13.3 r4
Juniper Junos Space	Version 14.1
Juniper Junos Space	Version 14.1 r1
Juniper Junos Space	Version 14.1 r2
Juniper Junos Space	Version 14.1 r3
Juniper Junos Space	Version 15.1
Juniper Junos Space	Version 15.1 r2
Juniper Junos Space	Version 15.1 r3
Juniper Junos Space	Version 15.1 r4
Juniper Junos Space	Version 15.2
Juniper Junos Space	Version 15.2 r2
Juniper Junos Space	Version 16.1
Juniper Junos Space	Version 16.1
Juniper Junos Space	Version 16.1 r1
Juniper Junos Space	Version 16.1 r2
Juniper Junos Space	Version 16.1 r3
Juniper Junos Space	Version 16.1r3
Juniper Junos Space	Version 17.1
Juniper Junos Space	Version 17.1 r1
Juniper Junos Space	Version 17.2
Juniper Junos Space	Version 17.2 r1.4
Juniper Junos Space	Version 18.1
Juniper Junos Space	Version 18.1r1
Juniper Junos Space	Version 18.2
Juniper Junos Space	Version 18.3
Juniper Junos Space	Version 18.4
Juniper Junos Space	Version 19.1
Juniper Junos Space	Version 2.0
Juniper Junos Space	Version 20.3 r1
Juniper Junos Space	Version 21.1 r1
Juniper Junos Space	Version 21.2 r1
Juniper Junos Space	Version 21.3 r1
Juniper Junos Space	Version 22.1 r1
Juniper Junos Space	Version 22.2 r1
Juniper Junos Space	Version 22.3 r1
Juniper Junos Space	Version 23.1 r1
Juniper Junos Space	Version 24.1 r1
Juniper Junos Space	Version 24.1 r2
Juniper Junos Space	Version 24.1 r3
Juniper Junos Space	Version 24.1 r4
Juniper Junos Space	Version 24.1 r5

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://kb.juniper.net/JSA106003

Source: sirt@juniper.net

Vendor Advisory

Timeline

No history available yet.