Barracuda SSL VPN 480 Multiple Unspecified HTML Injection Vulnerabilities

Bugtraq ID:	49595
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2011 12:00AM
Updated:	Mar 19 2015 09:32AM
Credit:	Vulnerability Lab
Vulnerable:	Barracuda Networks Barracuda SSL VPN 480 0
Not Vulnerable:

Barracuda SSL VPN 480 Multiple Unspecified HTML Injection Vulnerabilities

The Barracuda SSL VPN 480 is prone to multiple unspecified HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Barracuda SSL VPN 480 Multiple Unspecified HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Barracuda SSL VPN 480 Multiple Unspecified HTML Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Barracuda SSL VPN 480 Multiple Unspecified HTML Injection Vulnerabilities

References:

• Barracuda SSL VPN 480 - Multiple Web Vulnerabilities (Vulnerability Lab)
  
• Product Homepage (Barracuda Networks)