PT-2017-11813 · Pulse · Pulse Connect Secure

Publicado 2017-07-12 · Atualizado 2017-07-17 · CVE-2017-11194

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure version 8.3R1

Description The issue concerns a Reflected XSS in the adminservercacertdetails.cgi page of the admin panel. Specifically, the certid parameter of "adminservercacertdetails.cgi" is reflected in the application's response without proper sanitization, allowing an attacker to inject tags. This could enable an attacker to craft payloads that make the system execute commands such as ping, ping6, traceroute, nslookup, arp, etc.

Recommendations For Pulse Connect Secure version 8.3R1, as a temporary workaround, consider restricting access to the "adminservercacertdetails.cgi" page or sanitizing the certid parameter to prevent XSS attacks. Avoid using the certid parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11194

Produtos afetados

Pulse Connect Secure

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-11194 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11194 · Aviso do Fabricante
• https://twitter.com/sxcurity/status/884556905145937921 · Nota
• http://sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf · Nota