Darren Bounds has reported a vulnerability for Juniper DX, which can be exploited by malicious people to conduct script insertion attacks.

The vulnerability is caused due to insufficient filtering of the system log when displaying it in the web administration interface. This can be exploited to insert arbitrary HTML and script code via e.g. the username login field, which will be executed in a user's browser session in context of an affected site when malicious data is viewed.

The vulnerability has been reported for versions 5.1.x. Other versions may be also affected.

Solution
Restrict access to the web administration console to trusted users only.

Provided and/or discovered by
Darren Bounds

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047772.html

Deep Links
Links available to Secunia VIM customers