CVE-2017-11193

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi

published July 12, 2017

CVSS
—
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Published
2017-07-12T20:00Z
EPSS history
Timeline
  • 12 JUL 20:00Z
    Pulse Connect Secure 8.3R1 has CSRF in diag.cgi
    cvelistv5