CVE-2017-11195

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi

published July 12, 2017

CVSS
—
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.2th percentile
Published
2017-07-12T20:00Z
EPSS history
Timeline
  • 12 JUL 20:00Z
    Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi
    cvelistv5