CVE-2019-11507

In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.0 MITRE

5.8 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.80% chance of exploitation in the next 30 days, 90th percentile

Nuclei

medium · CWE-79

Published

2019-05-08

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11507.yaml

Security advisories

• https://kb.pulsesecure.net/?atype=sa
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
• http://www.securityfocus.com/bid/108073
• https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn…
• https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-N…
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
• https://www.kb.cert.org/vuls/id/927237

References

• CVE Record
• NVD entry