CVE-2018-20306: XSS
A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-20306?
CVE-2018-20306 is a stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager.
How does CVE-2018-20306 affect Pulse Secure Virtual Traffic Manager?
CVE-2018-20306 allows a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials.
Which versions of Pulse Secure Virtual Traffic Manager are affected by CVE-2018-20306?
Pulse Secure Virtual Traffic Manager versions 9.9r2 to 17.2r1 are affected by CVE-2018-20306.
What is the severity of CVE-2018-20306?
CVE-2018-20306 has a severity rating of 5.4 (medium).
How can I fix the CVE-2018-20306 vulnerability?
To fix the CVE-2018-20306 vulnerability, apply the necessary patches or updates provided by Pulse Secure.