vulnerability
Pulse Secure Pulse Connect Secure: CVE-2017-11196: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS) Cross Site Scripting Issue (SA40771)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Jul 12, 2017 | Oct 28, 2020 | Feb 15, 2024 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Jul 12, 2017
Added
Oct 28, 2020
Modified
Feb 15, 2024
Description
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
Solutions
pulse-secure-pulse-connect-secure-upgrade-8_0r17_0pulse-secure-pulse-connect-secure-upgrade-8_1r12_1pulse-secure-pulse-connect-secure-upgrade-8_2r8_2pulse-secure-pulse-connect-secure-upgrade-8_3r2_1
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.