CVE-2020-8238

Published: Sep 30, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

Affected (28)

Products: Ivanti: Connect Secure, Policy Secure · Pulsesecure: Pulse Connect Secure, Pulse Policy Secure

2 products

2 products

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	Version 9.1
Ivanti Connect Secure	Version 9.1 r1
Ivanti Connect Secure	Version 9.1 r2
Ivanti Connect Secure	Version 9.1 r3
Ivanti Connect Secure	Version 9.1 r4.1
Ivanti Connect Secure	Version 9.1 r4.2
Ivanti Connect Secure	Version 9.1 r4.3
Ivanti Connect Secure	Version 9.1 r4
Ivanti Connect Secure	Version 9.1 r5
Ivanti Connect Secure	Version 9.1 r6
Ivanti Connect Secure	Version 9.1 r7
Ivanti Connect Secure	Version 9.1 r8.1
Ivanti Connect Secure	Version 9.1 r8
Ivanti Policy Secure	Version 9.1
Ivanti Policy Secure	Version 9.1 r1
Ivanti Policy Secure	Version 9.1 r2
Ivanti Policy Secure	Version 9.1 r3
Ivanti Policy Secure	Version 9.1 r4.1
Ivanti Policy Secure	Version 9.1 r4.2
Ivanti Policy Secure	Version 9.1 r4.3
Ivanti Policy Secure	Version 9.1 r4
Ivanti Policy Secure	Version 9.1 r5
Ivanti Policy Secure	Version 9.1 r6
Ivanti Policy Secure	Version 9.1 r7
Ivanti Policy Secure	Version 9.1 r8.1
Ivanti Policy Secure	Version 9.1 r8
Pulsesecure Pulse Connect Secure	Up to 9.0
Pulsesecure Pulse Policy Secure	Up to 9.0