Lucene search

[email protected]CVE-2018-20306

HistoryDec 20, 2018 - 9:29 a.m.

CVE-2018-20306

2018-12-2009:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-20306

xss vulnerability

pulse secure virtual traffic manager

web administration

sensitive data

credentials

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.

Affected configurations

NVD

Node

pulsesecurevirtual_traffic_managerRange9.9–9.9r2

pulsesecurevirtual_traffic_managerRange10.4–10.4r1

pulsesecurevirtual_traffic_managerRange17.2–17.2r1

CPENameOperatorVersion
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managerlt9.9r2
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managerlt10.4r1
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managerlt17.2r1

CPE	Name	Operator	Version
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	lt	9.9r2
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	lt	10.4r1
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	lt	17.2r1

References

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

Related for CVE-2018-20306

nvd1 prion1 cvelist1