CVE-2017-17947: pulsesecure pulse_connect_secure Cross-site Scripting

Vulnerability summary

CVE-2017-17947 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in pulsesecure pulse_connect_secure. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities.

Timeline

1. 16-01-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.