Unscored severity · published Sep 29, 2014
CVE-2014-3820
Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before…
–
CVSS
0.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4 before 4.4r3 and 5.0 before 5.0r1 allows remote administrators to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Junos Pulse Access Control Service · Juniper
4.1; 4.1r1; 4.1r1.1; 4.1r2; 4.1r3; 4.1r4; +5 more · source: NVD
JP
Junos Pulse Secure Access Service · Juniper
7.1; 7.1r1; 7.1r1.1; 7.1r2; 7.1r3; 7.1r4; +15 more · source: NVD
Affected product
JP
Junos Pulse Access Control Service
Juniper
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3820
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3820
www.securitytracker.com
http://www.securitytracker.com/id/1030852
Vendor Advisory
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10645
More from Junos Pulse Access Control Service
–
CVE-2013-5650
Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before…
–
CVE-2013-3970
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1…