vulnerability
Pulse Secure Pulse Connect Secure: CVE-2017-11195: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS) Cross Site Scripting Issue (SA40771)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Jul 12, 2017 | Oct 28, 2020 | Feb 15, 2024 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Jul 12, 2017
Added
Oct 28, 2020
Modified
Feb 15, 2024
Description
Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.
Solutions
pulse-secure-pulse-connect-secure-upgrade-8_0r17_0pulse-secure-pulse-connect-secure-upgrade-8_1r12_1pulse-secure-pulse-connect-secure-upgrade-8_2r8_2pulse-secure-pulse-connect-secure-upgrade-8_3r2_1
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.