CVE-2017-11195

MEDIUM 6.1CVE-2017-11195 · Published 12/07/2017 · updated 17/06/2026

In short

CVE-2017-11195 is a MEDIUM (CVSS 6.1) vulnerability affecting pulse connect secure (pulsesecure).
Chance of exploitation in the next 30 days (EPSS): 0.90%, higher than 59.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pulse connect secure pulsesecure	`= 8.3r1.0`	No fix yet

Description

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.

References

securityfocus.com/bid/99615
sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf · Third Party Advisory
twitter.com/sxcurity/status/884556905145937921 · Third Party Advisory

More vulnerabilities in pulse connect secure

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pulse connect secure

pulsesecure

= 8.3r1.0

No fix yet

Description

More vulnerabilities in pulse connect secure

See all →