medium4.3Public exploit code
CVE-2012-4739
Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbitrary web script or…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Barracuda SSL VPN - 'fileSystem.do' Multiple Cross-Site Scripting Vulnerabilities2012-07-18 · remote · hardware · Verified
- Barracuda SSL VPN - 'launchAgent.do?return-To' Cross-Site Scripting2012-07-18 · remote · hardware · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbitrary web script or HTML via the (1) policyLaunching, (2) resourcePrefix, or (3) actionPath parameter in showUserResourceCategories.do; (4) list or (5) path parameter to fileSystem.do; or (6) return-To parameter to launchAgent.do.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Barracudanetworks | Barracuda Ssl Vpn | through 1.7.2.004 Versions 1.2.6.004, 1.5.0.29 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2012-08/0003.html
- http://www.securityfocus.com/bid/54761
- http://www.securitytracker.com/id?1027279
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77365
- https://www.barracudanetworks.com/ns/support/tech_alert.php
- http://archives.neohapsis.com/archives/bugtraq/2012-08/0003.html
- http://www.securityfocus.com/bid/54761
- http://www.securitytracker.com/id?1027279
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77365
- https://www.barracudanetworks.com/ns/support/tech_alert.php