PT-2013-5711 · Juniper Networks · Junos Pulse Secure Access Service

Published 2013-09-13 · Updated 2013-09-18 · CVE-2013-5649

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.1 through 7.1r14 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.2 through 7.2r10 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.3 through 7.3r5 Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS versions 7.4 through 7.4r2

Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving login pages. Additionally, remote authenticated users can inject arbitrary web script or HTML via vectors involving a support page.

Recommendations For versions 7.1 through 7.1r14, update to version 7.1r15 or later. For versions 7.2 through 7.2r10, update to version 7.2r11 or later. For versions 7.3 through 7.3r5, update to version 7.3r6 or later. For versions 7.4 through 7.4r2, update to version 7.4r3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-5649

Affected Products

Junos Pulse Secure Access Service

References · 3

• http://kb.juniper.net/JSA10589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5649 · Security Note
• http://osvdb.org/97240 · Note