CVE-2020-8238: XSS

Q: What is CVE-2020-8238?

CVE-2020-8238 is a vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 that allows for Cross-Site Scripting (XSS) attacks.

Q: What is the severity of CVE-2020-8238?

The severity of CVE-2020-8238 is medium, with a CVSS score of 6.1.

Q: How can attackers exploit CVE-2020-8238?

Attackers can exploit CVE-2020-8238 by conducting Cross-Site Scripting (XSS) attacks through the authenticated user web interface of affected Pulse Secure products.

Q: Which versions of Pulse Connect Secure and Pulse Policy Secure are affected by CVE-2020-8238?

Pulse Connect Secure and Pulse Policy Secure versions < 9.1R8.2 are affected by CVE-2020-8238.

Q: Where can I find more information about CVE-2020-8238?

More information about CVE-2020-8238 can be found in the Pulse Security Advisories and a blog post by GoSecure.

Published Sep 29, 2020

Updated

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

Affected Software

54 affected components

PulseSecure Pulse Connect Secure<=9.0

PulseSecure Pulse Connect Secure=9.1

PulseSecure Pulse Connect Secure=9.1-r1

PulseSecure Pulse Connect Secure=9.1-r2

PulseSecure Pulse Connect Secure=9.1-r3

PulseSecure Pulse Connect Secure=9.1-r4

PulseSecure Pulse Connect Secure=9.1-r4.1

PulseSecure Pulse Connect Secure=9.1-r4.2

PulseSecure Pulse Connect Secure=9.1-r4.3

PulseSecure Pulse Connect Secure=9.1-r5

PulseSecure Pulse Connect Secure=9.1-r6

PulseSecure Pulse Connect Secure=9.1-r7

PulseSecure Pulse Connect Secure=9.1-r8

PulseSecure Pulse Connect Secure=9.1-r8.1

PulseSecure Pulse Policy Secure<=9.0

PulseSecure Pulse Policy Secure=9.1

PulseSecure Pulse Policy Secure=9.1-r1

PulseSecure Pulse Policy Secure=9.1-r2

PulseSecure Pulse Policy Secure=9.1-r3

PulseSecure Pulse Policy Secure=9.1-r4

PulseSecure Pulse Policy Secure=9.1-r4.1

PulseSecure Pulse Policy Secure=9.1-r4.2

PulseSecure Pulse Policy Secure=9.1-r4.3

PulseSecure Pulse Policy Secure=9.1-r5

PulseSecure Pulse Policy Secure=9.1-r6

PulseSecure Pulse Policy Secure=9.1-r7

PulseSecure Pulse Policy Secure=9.1-r8

PulseSecure Pulse Policy Secure=9.1-r8.1

Ivanti Connect Secure=9.1

Ivanti Connect Secure=9.1-r1

Ivanti Connect Secure=9.1-r2

Ivanti Connect Secure=9.1-r3

Ivanti Connect Secure=9.1-r4

Ivanti Connect Secure=9.1-r4.1

Ivanti Connect Secure=9.1-r4.2

Ivanti Connect Secure=9.1-r4.3

Ivanti Connect Secure=9.1-r5

Ivanti Connect Secure=9.1-r6

Ivanti Connect Secure=9.1-r7

Ivanti Connect Secure=9.1-r8

Ivanti Connect Secure=9.1-r8.1

Ivanti Policy Secure=9.1

Ivanti Policy Secure=9.1-r1

Ivanti Policy Secure=9.1-r2

Ivanti Policy Secure=9.1-r3

Ivanti Policy Secure=9.1-r4

Ivanti Policy Secure=9.1-r4.1

Ivanti Policy Secure=9.1-r4.2

Ivanti Policy Secure=9.1-r4.3

Ivanti Policy Secure=9.1-r5

Ivanti Policy Secure=9.1-r6

Ivanti Policy Secure=9.1-r7

Ivanti Policy Secure=9.1-r8

Ivanti Policy Secure=9.1-r8.1

Event History

Sep 29, 2020

CVE Published

via MITRE·01:41 PM

Data Sourced

via MITRE·01:41 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-8238?

CVE-2020-8238 is a vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 that allows for Cross-Site Scripting (XSS) attacks.

What is the severity of CVE-2020-8238?

The severity of CVE-2020-8238 is medium, with a CVSS score of 6.1.

How can attackers exploit CVE-2020-8238?

Attackers can exploit CVE-2020-8238 by conducting Cross-Site Scripting (XSS) attacks through the authenticated user web interface of affected Pulse Secure products.

Which versions of Pulse Connect Secure and Pulse Policy Secure are affected by CVE-2020-8238?

Pulse Connect Secure and Pulse Policy Secure versions < 9.1R8.2 are affected by CVE-2020-8238.

Where can I find more information about CVE-2020-8238?