Lucene search

[email protected]CVE-2019-11543

HistoryApr 26, 2019 - 2:29 a.m.

CVE-2019-11543

2019-04-2602:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2019-11543

xss

admin

web console

pulse secure

pulse connect secure

pulse policy secure

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.

Affected configurations

NVD

Node

ivanticonnect_secureMatch8.1

ivanticonnect_secureMatch8.3

pulsesecurepulse_connect_secureMatch8.1r1.0

pulsesecurepulse_connect_secureMatch8.1rx

pulsesecurepulse_connect_secureMatch8.3rx

pulsesecurepulse_connect_secureMatch9.0r1

pulsesecurepulse_connect_secureMatch9.0r2

pulsesecurepulse_connect_secureMatch9.0r2.1

pulsesecurepulse_connect_secureMatch9.0r3

pulsesecurepulse_connect_secureMatch9.0r3.1

pulsesecurepulse_connect_secureMatch9.0r3.2

pulsesecurepulse_connect_secureMatch9.0rx

pulsesecurepulse_policy_secureMatch5.2r1.0

pulsesecurepulse_policy_secureMatch5.2r2.0

pulsesecurepulse_policy_secureMatch5.2r3.0

pulsesecurepulse_policy_secureMatch5.2r3.2

pulsesecurepulse_policy_secureMatch5.2r4.0

pulsesecurepulse_policy_secureMatch5.2r5.0

pulsesecurepulse_policy_secureMatch5.2r6.0

pulsesecurepulse_policy_secureMatch5.2r7.0

pulsesecurepulse_policy_secureMatch5.2r7.1

pulsesecurepulse_policy_secureMatch5.2r8.0

pulsesecurepulse_policy_secureMatch5.2r9.0

pulsesecurepulse_policy_secureMatch5.2r9.1

pulsesecurepulse_policy_secureMatch5.2r10.0

pulsesecurepulse_policy_secureMatch5.2r11.0

pulsesecurepulse_policy_secureMatch5.2rx

pulsesecurepulse_policy_secureMatch5.4r1

pulsesecurepulse_policy_secureMatch5.4r2

pulsesecurepulse_policy_secureMatch5.4r2.1

pulsesecurepulse_policy_secureMatch5.4r3

pulsesecurepulse_policy_secureMatch5.4r4

pulsesecurepulse_policy_secureMatch5.4r5

pulsesecurepulse_policy_secureMatch5.4r5.2

pulsesecurepulse_policy_secureMatch5.4r6

pulsesecurepulse_policy_secureMatch5.4r6.1

pulsesecurepulse_policy_secureMatch5.4r7

pulsesecurepulse_policy_secureMatch5.4rx

pulsesecurepulse_policy_secureMatch9.0r1

pulsesecurepulse_policy_secureMatch9.0r2

pulsesecurepulse_policy_secureMatch9.0r2.1

pulsesecurepulse_policy_secureMatch9.0r3

pulsesecurepulse_policy_secureMatch9.0r3.1

pulsesecurepulse_policy_secureMatch9.0rx

CPENameOperatorVersion
ivanti:connect_secureivanti connect secureeq8.1
ivanti:connect_secureivanti connect secureeq8.3
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq8.1r1.0
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq8.1rx
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq8.3rx
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq9.0r1
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq9.0r2
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq9.0r2.1
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq9.0r3
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq9.0r3.1

CPE	Name	Operator	Version
ivanti:connect_secure	ivanti connect secure	eq	8.1
ivanti:connect_secure	ivanti connect secure	eq	8.3
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	8.1r1.0
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	8.1rx
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	8.3rx
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	9.0r1
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	9.0r2
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	9.0r2.1
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	9.0r3
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	9.0r3.1

Rows per page:

1-10 of 441

References

www.securityfocus.com/bid/108073

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/

www.kb.cert.org/vuls/id/927237

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

Related for CVE-2019-11543

cvelist1 prion1 nvd1 nessus2 cert1