CVE-2019-11507: XSS

Published May 8, 2019

Updated

In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.

Affected Software

30 affected components

Ivanti Connect Secure=8.3-r1

Ivanti Connect Secure=8.3-r1.1

Ivanti Connect Secure=8.3-r2

Ivanti Connect Secure=8.3-r2.1

Ivanti Connect Secure=8.3-r3

Ivanti Connect Secure=8.3-r4

Ivanti Connect Secure=8.3-r5

Ivanti Connect Secure=8.3-r5.1

Ivanti Connect Secure=8.3-r5.2

Ivanti Connect Secure=8.3-r6

Ivanti Connect Secure=8.3-r6.1

Ivanti Connect Secure=8.3-r7

Ivanti Connect Secure=9.0-r1

Ivanti Connect Secure=9.0-r2

Ivanti Connect Secure=9.0-r2.1

PulseSecure Pulse Connect Secure=8.3-r1

PulseSecure Pulse Connect Secure=8.3-r1.1

PulseSecure Pulse Connect Secure=8.3-r2

PulseSecure Pulse Connect Secure=8.3-r2.1

PulseSecure Pulse Connect Secure=8.3-r3

PulseSecure Pulse Connect Secure=8.3-r4

PulseSecure Pulse Connect Secure=8.3-r5

PulseSecure Pulse Connect Secure=8.3-r5.1

PulseSecure Pulse Connect Secure=8.3-r5.2

PulseSecure Pulse Connect Secure=8.3-r6

PulseSecure Pulse Connect Secure=8.3-r6.1

PulseSecure Pulse Connect Secure=8.3-r7

PulseSecure Pulse Connect Secure=9.0-r1

PulseSecure Pulse Connect Secure=9.0-r2

PulseSecure Pulse Connect Secure=9.0-r2.1

Remediation

Patch Available

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/

Event History

May 8, 2019

CVE Published

via MITRE·04:52 PM

Data Sourced

via MITRE·04:52 PM

DescriptionSeverity

Frequently Asked Questions

What is CVE-2019-11507?

CVE-2019-11507 is a vulnerability in Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 that allows for cross-site scripting (XSS) attacks on the Application Launcher page.

How severe is CVE-2019-11507?

CVE-2019-11507 has a severity score of 6.1, which is considered medium.

How does CVE-2019-11507 affect Pulse Connect Secure?

CVE-2019-11507 affects Pulse Connect Secure versions 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3.

How can CVE-2019-11507 be exploited?

CVE-2019-11507 can be exploited through cross-site scripting (XSS) attacks on the Application Launcher page of Pulse Connect Secure.

Are there any references or resources available for CVE-2019-11507?

Yes, you can find more information about CVE-2019-11507 at the following sources: [1] SecurityFocus, [2] Devco.re blog, [3] Black Hat presentation on infiltrating corporate intranets.