CVE-2026-21904
Estado: AnalizadaMedia (5.1)—
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the
list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.
This issue affects all versions of Junos Space before 24.1R5 Patch V3.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-21904",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-21904",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-04-10T14:14:36.676713Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.1,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "ACTIVE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "sirt@juniper.net",
"affectedData": [
{
"vendor": "Juniper Networks",
"product": "Junos Space",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.1R5 Patch V3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-04-09T22:16:24.557",
"references": [
{
"url": "https://kb.juniper.net/JSA106003",
"tags": [
"Vendor Advisory"
],
"source": "sirt@juniper.net"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the \n\nlist filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.\n\nThis issue affects all versions of Junos Space before 24.1R5 Patch V3."
}
],
"lastModified": "2026-07-08T03:17:14.290",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:juniper:junos_space:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "289CAAE5-882C-4236-BF76-B20F8A7F3014"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA36F3E8-0F58-4635-843C-B3C62FD48682"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEA96869-72CF-49D2-94E1-4FF8102A29CA"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21DA6F2F-72F5-4D3A-AB4C-2C5D56C615FF"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6CF9AF7-A335-4C05-9F45-08253A521D40"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87F7E9A7-CA85-4F4D-8F0C-DF0C79A80B93"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:11.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61A323AE-7C8D-49F3-BB47-15DEBAFC86BD"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:11.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EAEC058B-C096-455B-9A75-5191E00A367D"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:11.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6E79208-AF42-48D9-990C-E2E2E1DE8E1E"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:11.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA5E2C05-12C0-48B6-BE84-0A045B2A2B91"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:12.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "167749D0-F3B8-48F3-BFC8-37A531E48C16"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:12.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4C754E5-ACBB-45DE-B983-0888A8EB7CD3"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:12.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84E7CE7F-4410-461D-9381-B186789B6509"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BE1AAAA-0C4E-4059-96E7-4D118BF2DBEF"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.1:r1.8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04858E4C-720A-400E-81AF-B5572424B351"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B610137-66AC-43D3-BBAE-4390011C20AC"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53C917DF-0507-45C8-89FE-29F400C35030"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "677B0C4D-923A-4376-85A8-56208E3728A3"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDEF52F5-ABE3-453C-9A5C-7FD5CCC18F09"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B7BBF07-791C-43FE-AC38-EB68493092BC"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5B55D33-A294-4DE2-887D-6A7E29F7EEE8"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DA50B20-F26E-4FB7-A46A-74836CF546A0"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BA008EC-659A-43CC-9741-E765958BD824"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB63AB30-45A0-40A3-8C45-1BBAA501B2A4"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31B0594A-AA98-4C17-9646-9DF7620089A5"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D81E5484-5C0D-44CB-90A8-65EE4E7D4F92"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EDD9296-6FB1-45E2-80EE-9F0F84CAFC94"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A53A9542-72FD-40E8-94F1-C7C0D776D726"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC29AA1D-4CBC-413A-9333-72F3616CE918"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00FCCF10-B612-46FC-94E6-70082F2E1091"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5F85CA0-36F3-48EE-8D35-A986412C91D9"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61813043-BAED-4803-9D5B-7B7E113D2FBD"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0D618D6-F413-47DD-BD26-4F62B7227A7F"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5A79F3A-80B9-4D98-92EE-681ED2E716B8"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD833CE8-F37B-4EEB-9DD3-E8A8BB121390"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E4B00D0-93F9-4145-BA91-6F4A66F19854"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74CB3FCB-192A-48A7-9FF3-3D228729AC60"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:15.2:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "139FA36E-582D-41E9-AC4F-9BD49C844039"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67829EE9-39AE-43C5-91FE-A911F5C99346"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EB54773-A54F-4D9E-B213-464421B4FA88"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC8CBF0A-310F-41EB-B377-F08FE03E3867"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62BB74B8-C90B-4CA1-B8CE-29F8D42D4B46"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44855E13-5493-4362-B7E8-5A1A6F299FFC"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:16.1r3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC82CE95-E9A7-4B1E-9DEE-FFF24EED713E"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:17.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28D46176-27CE-4EAF-AF83-83F81A798103"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:17.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "430F2EBF-09EB-4F48-ACF8-8B4EDF83E284"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:17.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3EAC6FC-A2DC-4EF1-BF56-93728A9CDDAA"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:17.2:r1.4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE35151C-FCF6-4A89-8283-B24225019241"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:18.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "041D10A1-B577-4109-A98D-DA20560FDA37"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:18.1r1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D82DF30A-C838-49AC-95DC-16D765FD5588"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:18.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FD83E88-0DD9-4584-B594-2839D15FA055"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:18.3:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F1FA208-9AC5-414A-917A-6595917440EC"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:18.4:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "746F17A3-C20A-495D-9EEA-635392ECE907"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:19.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F113B1F6-CF32-4BB4-A3C5-638D1531FE9F"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:20.3:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "326E02EB-2D43-4784-AF77-EAF364AFCA44"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:21.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "395C3952-0DD2-414E-BD71-34C636A60411"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:21.2:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAAD4A16-885D-403B-B7F0-D505F16117E1"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:21.3:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E35AACE-C693-4813-8A4C-84AF5CE31598"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:22.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A299BD3-E911-4B33-A759-088DADC0CF5C"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:22.2:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "022F09D3-1F23-459B-BA76-14FABB2CB2E6"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:22.3:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4679BFE4-F00C-4CA2-B7F5-93DC97C13A76"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:23.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B4163AD-07D3-4C60-9277-0ACCFBD24255"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0566970C-0E9B-4566-9920-C7C436A4243D"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2AA399D-5A7D-45B8-B774-D69054DFA4D3"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57CC4E1A-23AA-4B4A-8690-5EEDCBEC4BBE"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F39EC68-9DBB-4A30-BB44-1A26020079CB"
},
{
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18B71350-88B1-4644-8CDD-D31661A848F0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "sirt@juniper.net"
}