Tags › CVE-2013-5649
Juniper VPN SSL: client-side cross-site scripting
Published on Sep 12, 2013 in CVE-2013-5649, juniper, cross-site scripting, security advisory
- Vendor advisory: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10589
- Vulnerable product that was tested: MAG-2600, Version 7.2R3 (build 21397)
- CVE: CVE-2013-5649
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2013-01-juniper-junos-dom-xss/
Description
The Juniper VPN SSL system was found to be vulnerable to a client-side cross site scripting vulnerability.
Impact
Exploitation of this vulnerability may allow hijack of VPN SSL sessions. This usually involves a social engineering attack in order to convince a logged in victim to click on an attacker-supplied URL. Therefore such an attack would typically be the result of a targeted attack rather than an opportunistic one.
…