CVE-2017-11193: CSRF
Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11193?
CVE-2017-11193 is classified as a medium severity vulnerability due to its potential exploitation through CSRF attacks.
How do I fix CVE-2017-11193?
To mitigate CVE-2017-11193, it is recommended to upgrade Pulse Connect Secure to the latest version that includes security fixes.
What does CVE-2017-11193 affect?
CVE-2017-11193 affects Pulse Connect Secure version 8.3R1.0, specifically the diag.cgi file that handles command executions.
What kind of attacks can be performed using CVE-2017-11193?
CVE-2017-11193 allows an attacker to exploit CSRF to execute diagnostic commands such as ping and traceroute without user consent.
When was CVE-2017-11193 discovered?
CVE-2017-11193 was published on July 5, 2017, highlighting the issue of unprotected diagnostic functions in Pulse Connect Secure.