CVE-2020-8238

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

Score

CVSS 3.1 6.1 Medium

Status

Modified - support@hackerone.com

Published

2020-09-30

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Connect Secure (Ivanti)
• Policy Secure (Ivanti)
• Pulse Connect Secure Pulse Policy Secure (Pulse Secure)
• Pulse Connect Secure (Pulsesecure)
• Pulse Policy Secure (Pulsesecure)

References

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588
• https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/