CVE-2014-2291: XSS
Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2291?
The severity of CVE-2014-2291 is classified as high due to the potential for remote authenticated users to perform XSS attacks.
How do I fix CVE-2014-2291?
To fix CVE-2014-2291, update your Juniper Junos Pulse Secure Access Service to the latest version as listed in the vendor's advisories.
Who is affected by CVE-2014-2291?
CVE-2014-2291 affects users of Juniper Junos Pulse Secure Access Service running IVE OS versions prior to 7.1r18, 7.3r10, 7.4r8, and 8.0r1.
What types of attacks can CVE-2014-2291 facilitate?
CVE-2014-2291 can facilitate cross-site scripting (XSS) attacks that allow attackers to inject arbitrary web script or HTML.
Is user authentication required for CVE-2014-2291 exploitation?
Yes, exploitation of CVE-2014-2291 requires that the attacker be a remote authenticated user.