PT-2019-12341 · Pulse Secure · Pulse Connect Secure

Publicado 2019-05-08 · Atualizado 2024-02-27 · CVE-2019-11507

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure (PCS) versions 8.3.x through 8.3R7.0 Pulse Secure Pulse Connect Secure (PCS) versions 9.0.x through 9.0R2

Description An XSS issue has been found on the Application Launcher page.

Recommendations For Pulse Secure Pulse Connect Secure (PCS) versions 8.3.x through 8.3R7.0, update to version 8.3R7.1 or later. For Pulse Secure Pulse Connect Secure (PCS) versions 9.0.x through 9.0R2, update to version 9.0R3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11507

Produtos afetados

Pulse Connect Secure

Referências · 12

• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• https://kb.pulsesecure.net/?atype=sa · Aviso do Fabricante
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11507 · Nota de Segurança
• https://t.me/cvenotify/72494 · Publicação no Telegram
• https://kb.cert.org/vuls/id/927237 · Nota
• http://securityfocus.com/bid/108073 · Nota
• https://osv.dev/vulnerability/CVE-2019-11507 · Aviso do Fabricante
• https://t.me/cvenotify/46788 · Publicação no Telegram
• https://t.me/cvenotify/67389 · Publicação no Telegram
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Aviso do Fabricante