CVE-2025-59974

An attacker with administrator privileges injects malicious JavaScript code into the application, which is permanently stored (stored XSS). When other users visit pages affected by the vulnerability, the browser automatically executes the stored script in the context of their session. This can lead to session theft, interception of authentication data, or execution of unauthorized actions on behalf of the victim. The vulnerability results from improper neutralization of input data during web page content generation (CWE-79).

An attacker can hijack sessions of other users, steal authentication credentials, and in the case of victims with elevated privileges — gain broad access to network security management functions. High impact on confidentiality, integrity, and availability in both the system context and dependent environment indicates the possibility of serious, cascading consequences.

Juniper Space Security Director should be updated to version 24.1R4 or later. Details available in the vendor's guide: https://supportportal.juniper.net/JSA103139

Juniper Space Security Director — all versions before 24.1R4