XSS in Microsoft Forefront Unified Access Gateway

CVE-2011-1897

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.084 (94.4th percentile) — read the EPSS interpretation.

Affected products

Microsoft Forefront_unified_access_gateway — versions 2010
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
secure@microsoft.com (x_refsource_MS, vendor-advisory)