[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Juniper Secure Access XSS Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Juniper Secure Access XSS Vulnerability
- From: Anil Pazvant <pazwant@xxxxxxxxx>
- Date: Mon, 22 Jul 2013 19:30:29 +0200
-------------------------------------------------------------------------------
| Juniper Secure Access XSS Vulnerability|
--------------------------------------------------------------------------------
Summary
===============
Juniper Secure Access software has reflected XSS vulnerability
CVE number: CVE-2012-5460
PSN-2013-03-874
Impact: Low
Vendor homepage:
http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2013-03-874&viewMode=view
Vendor notified: 06/06/2012
Vendor fixed: 12/12/2012
Affected Products
=================
Juniper SA (IVE OS) to versions prior to 7.1r13, 7.2r7, 7.3r2 .
Details
==================
In order to exploit this vulnerability , the client should
authenticate to SSLVPN service.The vulnerable parameter exists on help
page of IVE user web interface.
Effected parameter: WWHSearchWordsText
Impact
==================
Execution of arbitrary script code in a user's browser during an
authenticated session.
Solution
==================
Upgrade to 7.1r13, 7.2r7, 7.3r2, or higher.
Twitter @pazwant