CVE-2017-11195: XSS
Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11195?
CVE-2017-11195 has a moderate severity due to its potential for reflected XSS attacks.
How do I fix CVE-2017-11195?
To fix CVE-2017-11195, upgrade Pulse Connect Secure to the latest version that addresses this XSS vulnerability.
What is the impact of CVE-2017-11195?
The impact of CVE-2017-11195 includes the possibility for attackers to execute arbitrary scripts in the context of the user's session.
Which versions of Pulse Connect Secure are affected by CVE-2017-11195?
CVE-2017-11195 affects Pulse Connect Secure version 8.3R1.0.
Is CVE-2017-11195 related to Cross-Site Scripting vulnerabilities?
Yes, CVE-2017-11195 is specifically a reflected XSS vulnerability.