------------------------------------------------------------------------------- | Juniper Secure Access XSS Vulnerability| -------------------------------------------------------------------------------- Summary =============== Juniper Secure Access software has reflected XSS vulnerability CVE number: CVE-2012-5460 PSN-2013-03-874 Impact: Low Vendor homepage: http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2013-03-874&viewMode=view Vendor notified: 06/06/2012 Vendor fixed: 12/12/2012 Affected Products ================= Juniper SA (IVE OS) to versions prior to 7.1r13, 7.2r7, 7.3r2 . Details ================== In order to exploit this vulnerability , the client should authenticate to SSLVPN service.The vulnerable parameter exists on help page of IVE user web interface. Effected parameter: WWHSearchWordsText Impact ================== Execution of arbitrary script code in a user's browser during an authenticated session. Solution ================== Upgrade to 7.1r13, 7.2r7, 7.3r2, or higher. Twitter @pazwant