Upgrade: Junos Pulse Secure Access Service 7.1r15/7.2r11/7.3r6/7.4r3 Timeline info đ Nessus Name: Juniper Junos Pulse Secure Access Service IVE OS (SSL VPN) Multiple XSS (JSA10589)ÄȘctive APT Groups: đ Countermeasures info Recommended: Upgrade Entry connected to this vulnerability is available at 10292. The vulnerability is also documented in the databases at X-Force ( 87062), Vulnerability Center ( SBV-41570) and Tenable ( 70025). A possible mitigation has been published immediately after the disclosure of the vulnerability. Upgrading to version 7.1r15, 7.2r11, 7.3r6 or 7.4r3 eliminates this vulnerability. The vulnerability scanner Nessus provides a plugin with the ID 70025 (Juniper Junos Pulse Secure Access Service IVE OS (SSL VPN) Multiple XSS (JSA10589)), which helps to determine the existence of the flaw in a target environment.
The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK. The technical details are unknown and an exploit is not publicly available. It demands that the victim is doing some kind of user interaction. The exploitation doesn't need any form of authentication. This vulnerability is known as CVE-2013-5649 since. It is possible to read the advisory at kb. The weakness was released by Sandro Gauci with EnableSecurity as JSA10589 as confirmed advisory (Website). As an impact it is known to affect confidentiality, integrity, and availability. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The CWE definition for the vulnerability is CWE-79. The manipulation with an unknown input leads to a cross site scripting vulnerability. Affected by this vulnerability is an unknown functionality of the component SSL VPN Web Server. A high score indicates an elevated risk to be targeted for this vulnerability.ÄȘ vulnerability has been found in Juniper Junos Pulse Secure Access Service 7.1r14/7.2r10/7.3r5/7.4r2 ( Router Operating System) and classified as critical. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks.
0 kommentar(er)
