PT-2013-5711 · Juniper Networks · Junos Pulse Secure Access Service

Publicado 2013-09-13 · Atualizado 2013-09-18 · CVE-2013-5649

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.1 through 7.1r14 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.2 through 7.2r10 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.3 through 7.3r5 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.4 through 7.4r2

Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving login pages. Additionally, remote authenticated users can inject arbitrary web script or HTML via vectors involving a support page.

Recommendations For versions 7.1 through 7.1r14, update to version 7.1r15 or later. For versions 7.2 through 7.2r10, update to version 7.2r11 or later. For versions 7.3 through 7.3r5, update to version 7.3r6 or later. For versions 7.4 through 7.4r2, update to version 7.4r3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-5649

Produtos afetados

Junos Pulse Secure Access Service

Referências · 3

• http://osvdb.org/97240 · Nota
• http://kb.juniper.net/JSA10589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-5649 · Nota de Segurança