CVE-2013-3970
published 2013-06-13CVE-2013-3970: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
0.49%
38.6th percentile
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos_os | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_access_control_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
| juniper | junos_pulse_secure_access_service | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ivanti
Ivanti Security Advisory: CVE-2013-3970
vendor_ivanti·2013-06-13
CVE-2013-3970 CWE-310 Ivanti Security Advisory: CVE-2013-3970
Ivanti Security Advisory: CVE-2013-3970
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.
CVE IDs: CVE-2013-3970
CWEs: CWE-310
Juniper
CVE-2013-3970: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service
vendor_juniper·2013-06-13·CVSS 4.3
CVE-2013-3970 [MEDIUM] CWE-310 CVE-2013-3970: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service
CVE-2013-3970: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.
GHSA
GHSA-x2pg-v5fr-hp3f: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7
ghsa_unreviewed·2022-05-17
CVE-2013-3970 [MEDIUM] GHSA-x2pg-v5fr-hp3f: Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7
Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2013-06-13
Published