CVE-2017-11194: XSS
Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11194?
CVE-2017-11194 has a medium severity rating, as it involves reflected Cross-Site Scripting (XSS) vulnerabilities.
How do I fix CVE-2017-11194?
To fix CVE-2017-11194, ensure that your Pulse Connect Secure software is updated to a version that addresses this vulnerability.
What type of vulnerability is CVE-2017-11194?
CVE-2017-11194 is classified as a reflected Cross-Site Scripting (XSS) vulnerability.
Which versions of Pulse Connect Secure are affected by CVE-2017-11194?
CVE-2017-11194 affects Pulse Connect Secure version 8.3R1.0.
What can an attacker achieve by exploiting CVE-2017-11194?
An attacker exploiting CVE-2017-11194 can inject malicious scripts into the administrator panel, potentially compromising admin credentials.