Juniper Networks Junos Pulse SSL VPN Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	61418
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 24 2013 12:00AM
Updated:	Jul 24 2013 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	Juniper Networks SA700 SSL VPN 0 Juniper Networks SA6500 SSL VPN 0 Juniper Networks SA6500 FIPS 0 Juniper Networks SA6000 SSL VPN 0 Juniper Networks SA6000 FIPS 0 Juniper Networks SA4500 SSL VPN 0 Juniper Networks SA4000 SSL VPN 0 Juniper Networks SA2500 SSL VPN 0 Juniper Networks SA2000 SSL VPN 0
Not Vulnerable:

Juniper Networks Junos Pulse SSL VPN Multiple Cross Site Scripting Vulnerabilities

Juniper Networks Junos Pulse is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Juniper Networks Junos Pulse SSL VPN Multiple Cross Site Scripting Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI.

Juniper Networks Junos Pulse SSL VPN Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Juniper Networks Junos Pulse SSL VPN Multiple Cross Site Scripting Vulnerabilities

References:

• Juniper Networks Homepage (Juniper Networks)