jQuery Vulnerability on Access Server Login Page

jeaguilar

Is it possible for me to modify the code that generates the "OpenVPN Connect" page for the Access Server?

We had a vulnerability scan come back with the finding that the version of jQuery in use is susceptible to XSS and the required remediation is to use a version of jQuery > 1.6.1. The version in use is called from "js/lib/jquery-1.4.2.min.js" but this must be generated when the server starts.

I tried opening a support ticket but it's been sitting in the queue untouched since last week.

Thanks.

danlherman

Did you get any update on this? I'm having the exact same issue.

Thanks,
Dan

jeaguilar

Hello Juan,

We'll look into updating that library so the scan can be passed.

Kind regards,
Johan Draaisma
OpenVPN Technologies, Inc.

That was on 9/24/15 and I didn't get any follow-up so I bumped the ticket today since it's still open.

What I ended up having to do is to not permit regular access to the page, only opening it up temporarily when needed for initial download of a profile file.

Good luck.

danlherman

Thanks for the update. I put in a support request as well.