Unscored severity · published Jun 13, 2013
CVE-2013-3970
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Junos Pulse Access Control Service · Juniper
4.1r1; 4.1r1.1; 4.1r2; 4.1r3; 4.1r4; 4.1r5 · source: NVD
JP
Junos Pulse Secure Access Service · Juniper
7.0r2; 7.0r3; 7.0r4; 7.0r5; 7.0r5.1; 7.0r6; +8 more · source: NVD
Affected product
JP
Junos Pulse Access Control Service
Juniper
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3970
Patch
http://kb.juniper.net/JSA10571
More from Junos Pulse Access Control Service
–
CVE-2014-3820
Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before…
–
CVE-2013-5650
Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before…