CVE-2018-20306

Published: Dec 20, 2018Modified: Nov 21, 2024

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.

Affected (3)

Products: Pulsesecure: Virtual Traffic Manager

Pulsesecure

1 product

Virtual Traffic Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pulsesecure Virtual Traffic Manager	From 10.4 to 10.4r1
Pulsesecure Virtual Traffic Manager	From 17.2 to 17.2r1
Pulsesecure Virtual Traffic Manager	From 9.9 to 9.9r2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

Source: cve@mitre.org

Vendor Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.