ByteOS Network

NVD Vulnerability Details :

CVE-2017-17947

Analyzed

Source-cve@mitre.org

Published At-16 Jan, 2018 | 21:29

Updated At-06 Feb, 2018 | 15:24

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	4.8	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

Pulse Secure

>>pulse_connect_secure>>Versions before 8.0r17.0(exclusive)

cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*

Pulse Secure

>>pulse_connect_secure>>Versions from 8.1(inclusive) to 8.1r13(exclusive)

cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*

Pulse Secure

>>pulse_connect_secure>>Versions from 8.2(inclusive) to 8.2r9(inclusive)

cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*

Pulse Secure

>>pulse_connect_secure>>Versions from 8.3(inclusive) to 8.3r3(exclusive)

cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018	cve@mitre.org	Patch Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History