CVE-2025-59978

critical · 9.4

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.

9.4

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2025-10-09

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
juniper	junos_space	< 24.1
juniper	junos_space	24.1
juniper	junos_space	24.1
juniper	junos_space	24.1

Check a specific version with /api/v1/cve/match.

References

https://supportportal.juniper.net/JSA103140

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-59978