CVE-2022-21826

2022-09-3016:24:25

CWE-444

hackerone

www.cve.org

pulse secure

http request smuggling

post request

xss

vulnerability

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request’s Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.

CNA Affected

[
  {
    "product": "Pulse Connect Secure VPN Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "9.1R14 and below"
      }
    ]
  }
]