CVE-2017-11196: CSRF
Published Jul 12, 2017
·Updated
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
Affected Software
1 affected component
PulseSecure Pulse Connect Secure=8.3r1.0
Event History
Jul 12, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-11196?
CVE-2017-11196 has a medium severity level due to its potential to allow unauthorized user logout.
2
How do I fix CVE-2017-11196?
To fix CVE-2017-11196, ensure your Pulse Connect Secure version is updated to a release that includes CSRF protection for logout functionality.
3
What systems are affected by CVE-2017-11196?
CVE-2017-11196 specifically affects Pulse Connect Secure version 8.3R1.
4
What type of attack can be executed due to CVE-2017-11196?
An attacker can perform a Cross-Site Request Forgery (CSRF) attack to log out users without their consent.
5
Is user data compromised if CVE-2017-11196 is exploited?
Exploiting CVE-2017-11196 primarily affects session management, but it does not directly compromise user data.