PT-2019-12341 · Pulse Secure · Pulse Connect Secure

Published 2019-05-08 · Updated 2024-02-27 · CVE-2019-11507

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure (PCS) versions 8.3.x through 8.3R7.0 Pulse Secure Pulse Connect Secure (PCS) versions 9.0.x through 9.0R2

Description An XSS issue has been found on the Application Launcher page.

Recommendations For Pulse Secure Pulse Connect Secure (PCS) versions 8.3.x through 8.3R7.0, update to version 8.3R7.1 or later. For Pulse Secure Pulse Connect Secure (PCS) versions 9.0.x through 9.0R2, update to version 9.0R3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11507

Affected Products

Pulse Connect Secure

References · 12

• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• https://kb.pulsesecure.net/?atype=sa · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11507 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11507 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 · Note
• https://t.me/cvenotify/72494 · Telegram Post
• https://kb.cert.org/vuls/id/927237 · Note
• http://securityfocus.com/bid/108073 · Note
• https://t.me/cvenotify/46788 · Telegram Post
• https://t.me/cvenotify/67389 · Telegram Post