Juniper Junos OS J-Web Missing X-Frame-Options Clickjacking Vulnerability (CVE-2015-3004) Advisory

Key Information Vulnerability ID: CVE-2015-3004 Affected Products: Any product or platform running Junos OS with J-Web enabled Severity: Low CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) Issue Junos J-Web lacks the 'X-Frame-Options' HTTP header, which may allow Clickjacking attacks against authenticated or unauthenticated pages in J-Web. Attackers could potentially trick J-Web users into performing certain administrative tasks. Solution J-Web now includes the appropriate 'X-Frame-Options' header in HTTP responses. For older browsers that do not support the 'X-Frame-Options' header, defensive code has been added to the UI. Software versions that fix this issue include: 11.4R12, 12.1X44-D35, 12.1X46-D25, 12.1X47-D10, 12.3X48-D10, 12.2R9, 12.3R7, 13.2R6, 13.2X51-D20, 13.3R5, 14.1R3, 14.1X53-D10, 14.2R1, and all subsequent versions. Additional Solution Information This issue is being tracked via PR 969531 and is visible on the customer support website. Solution Modification Information KB16765 - "Which Versions Fix the Vulnerability?" describes the vulnerabilities fixed in each supported Junos version. Workaround Use a dedicated browser for J-Web and log out after use, or disable J-Web when not needed. Modification History 2015-04-08: Initial release Related Information KB16613: Juniper Networks SIRT Quarterly Security Bulletin Release Process Overview KB16765: Which Versions Fix the Vulnerability? KB16446: Common Vulnerability Scoring System (CVSS) and Juniper Security Bulletins Report a Security Vulnerability - How to Contact Juniper Networks Security Incident Response Team

Goal Reached Thanks to every supporter — we hit 100%!

Juniper Junos OS J-Web Missing X-Frame-Options Clickjacking Vulnerability (CVE-2015-3004) Advisory