vulnerability

Pulse Secure Pulse Connect Secure: CVE-2017-11193: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS) Cross Site Scripting Issue (SA40771)

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Jul 12, 2017
Added
Oct 28, 2020
Modified
Feb 15, 2024

Description

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.

Solutions

pulse-secure-pulse-connect-secure-upgrade-8_0r17_0pulse-secure-pulse-connect-secure-upgrade-8_1r12_1pulse-secure-pulse-connect-secure-upgrade-8_2r8_2pulse-secure-pulse-connect-secure-upgrade-8_3r2_1
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.