CVE-2014-3820 Cross-site scripting in n/a
Remote administrators can inject arbitrary web script or HTML into the Juniper SSL VPN web server, potentially compromising the interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-3820?
CVE-2014-3820 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Sep 2014. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4 before 4.4r3 and 5.0 before 5.0r1 allows remote administrators to inject arbitrary web script or HTML via unspecified vectors.
Weakness: CWE-79
Which versions are affected by CVE-2014-3820?
It affects 2 products.
Products include Juniper Junos Pulse Access Control Service, Juniper Junos Pulse Secure Access Service.
How do I fix CVE-2014-3820?
No fix has been published for CVE-2014-3820 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2014-3820 being exploited?
There is no known exploitation of CVE-2014-3820 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6g26-h884-xwv8.