VIR Vulnerability Intelligence Relay

CVE-2014-3820

medium
Published 2014-09-29 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
4.3

Description

Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4 before 4.4r3 and 5.0 before 5.0r1 allows remote administrators to inject arbitrary web script or HTML via unspecified vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
juniperjunos_pulse_access_control_service4.1
juniperjunos_pulse_access_control_service4.1r1
juniperjunos_pulse_access_control_service4.1r1.1
juniperjunos_pulse_access_control_service4.1r2
juniperjunos_pulse_access_control_service4.1r3
juniperjunos_pulse_access_control_service4.1r4
juniperjunos_pulse_access_control_service4.1r5
juniperjunos_pulse_access_control_service4.4
juniperjunos_pulse_access_control_service5.0
juniperjunos_pulse_secure_access_service7.1
juniperjunos_pulse_secure_access_service7.1r1
juniperjunos_pulse_secure_access_service7.1r1.1
juniperjunos_pulse_secure_access_service7.1r2
juniperjunos_pulse_secure_access_service7.1r3
juniperjunos_pulse_secure_access_service7.1r4
juniperjunos_pulse_secure_access_service7.1r5
juniperjunos_pulse_secure_access_service7.1r6
juniperjunos_pulse_secure_access_service7.1r7
juniperjunos_pulse_secure_access_service7.1r8
juniperjunos_pulse_secure_access_service7.1r9
juniperjunos_pulse_secure_access_service7.1r10
juniperjunos_pulse_secure_access_service7.1r11
juniperjunos_pulse_secure_access_service7.1r12
juniperjunos_pulse_secure_access_service7.1r13
juniperjunos_pulse_secure_access_service7.1r14
juniperjunos_pulse_secure_access_service7.1r15
juniperjunos_pulse_secure_access_service7.4
juniperjunos_pulse_secure_access_service8.0

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.