CVE-2021-22936: XSS
Published Aug 16, 2021
·Updated
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.
Affected Software
25 affected components
PulseSecure Pulse Connect Secure<9.1
PulseSecure Pulse Connect Secure=9.1
PulseSecure Pulse Connect Secure=9.1-r1.0
PulseSecure Pulse Connect Secure=9.1-r10.0
PulseSecure Pulse Connect Secure=9.1-r11.0
PulseSecure Pulse Connect Secure=9.1-r2.0
PulseSecure Pulse Connect Secure=9.1-r3.0
PulseSecure Pulse Connect Secure=9.1-r4.0
PulseSecure Pulse Connect Secure=9.1-r5.0
PulseSecure Pulse Connect Secure=9.1-r6.0
PulseSecure Pulse Connect Secure=9.1-r7.0
PulseSecure Pulse Connect Secure=9.1-r8.0
PulseSecure Pulse Connect Secure=9.1-r9.0
Ivanti Connect Secure=9.1
Ivanti Connect Secure=9.1-r1.0
Ivanti Connect Secure=9.1-r10.0
Ivanti Connect Secure=9.1-r11.0
Ivanti Connect Secure=9.1-r2.0
Ivanti Connect Secure=9.1-r3.0
Ivanti Connect Secure=9.1-r4.0
Ivanti Connect Secure=9.1-r5.0
Ivanti Connect Secure=9.1-r6.0
Ivanti Connect Secure=9.1-r7.0
Ivanti Connect Secure=9.1-r8.0
Ivanti Connect Secure=9.1-r9.0
Event History
Aug 16, 2021
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22936?
The severity of CVE-2021-22936 is medium with a CVSS score of 6.1.
2
How does CVE-2021-22936 affect Pulse Connect Secure?
CVE-2021-22936 affects Pulse Connect Secure versions before 9.1R12.
3
What is the vulnerability type of CVE-2021-22936?
CVE-2021-22936 is a cross-site scripting (XSS) vulnerability.
4
How can a threat actor exploit CVE-2021-22936?
A threat actor can exploit CVE-2021-22936 by performing a cross-site scripting attack against an authenticated administrator via an unsanitized web parameter.
5
Is there a fix available for CVE-2021-22936?
Yes, a fix for CVE-2021-22936 is available in Pulse Connect Secure version 9.1R12.