Lucene search

MitreCVE-2019-11543

HistoryApr 26, 2019 - 2:29 a.m.

CVE-2019-11543

2019-04-2602:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2019-11543

xss

admin

web console

pulse secure

pulse connect secure

pulse policy secure

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.

Affected configurations

Nvd

Node

ivanticonnect_secureMatch8.1

ivanticonnect_secureMatch8.3

pulsesecurepulse_connect_secureMatch8.1r1.0

pulsesecurepulse_connect_secureMatch8.1rx

pulsesecurepulse_connect_secureMatch8.3rx

pulsesecurepulse_connect_secureMatch9.0r1

pulsesecurepulse_connect_secureMatch9.0r2

pulsesecurepulse_connect_secureMatch9.0r2.1

pulsesecurepulse_connect_secureMatch9.0r3

pulsesecurepulse_connect_secureMatch9.0r3.1

pulsesecurepulse_connect_secureMatch9.0r3.2

pulsesecurepulse_connect_secureMatch9.0rx

pulsesecurepulse_policy_secureMatch5.2r1.0

pulsesecurepulse_policy_secureMatch5.2r2.0

pulsesecurepulse_policy_secureMatch5.2r3.0

pulsesecurepulse_policy_secureMatch5.2r3.2

pulsesecurepulse_policy_secureMatch5.2r4.0

pulsesecurepulse_policy_secureMatch5.2r5.0

pulsesecurepulse_policy_secureMatch5.2r6.0

pulsesecurepulse_policy_secureMatch5.2r7.0

pulsesecurepulse_policy_secureMatch5.2r7.1

pulsesecurepulse_policy_secureMatch5.2r8.0

pulsesecurepulse_policy_secureMatch5.2r9.0

pulsesecurepulse_policy_secureMatch5.2r9.1

pulsesecurepulse_policy_secureMatch5.2r10.0

pulsesecurepulse_policy_secureMatch5.2r11.0

pulsesecurepulse_policy_secureMatch5.2rx

pulsesecurepulse_policy_secureMatch5.4r1

pulsesecurepulse_policy_secureMatch5.4r2

pulsesecurepulse_policy_secureMatch5.4r2.1

pulsesecurepulse_policy_secureMatch5.4r3

pulsesecurepulse_policy_secureMatch5.4r4

pulsesecurepulse_policy_secureMatch5.4r5

pulsesecurepulse_policy_secureMatch5.4r5.2

pulsesecurepulse_policy_secureMatch5.4r6

pulsesecurepulse_policy_secureMatch5.4r6.1

pulsesecurepulse_policy_secureMatch5.4r7

pulsesecurepulse_policy_secureMatch5.4rx

pulsesecurepulse_policy_secureMatch9.0r1

pulsesecurepulse_policy_secureMatch9.0r2

pulsesecurepulse_policy_secureMatch9.0r2.1

pulsesecurepulse_policy_secureMatch9.0r3

pulsesecurepulse_policy_secureMatch9.0r3.1

pulsesecurepulse_policy_secureMatch9.0rx

VendorProductVersionCPE
ivanticonnect_secure8.1cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:*
ivanticonnect_secure8.3cpe:2.3:a:ivanti:connect_secure:8.3:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure8.1r1.0cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1r1.0:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure8.1rxcpe:2.3:a:pulsesecure:pulse_connect_secure:8.1rx:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure8.3rxcpe:2.3:a:pulsesecure:pulse_connect_secure:8.3rx:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure9.0r1cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r1:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure9.0r2cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r2:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure9.0r2.1cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r2.1:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure9.0r3cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r3:*:*:*:*:*:*:*
pulsesecurepulse_connect_secure9.0r3.1cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ivanti	connect_secure	8.1	cpe:2.3:a:ivanti:connect_secure:8.1:::::::*
ivanti	connect_secure	8.3	cpe:2.3:a:ivanti:connect_secure:8.3:::::::*
pulsesecure	pulse_connect_secure	8.1r1.0	cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1r1.0:::::::*
pulsesecure	pulse_connect_secure	8.1rx	cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1rx:::::::*
pulsesecure	pulse_connect_secure	8.3rx	cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3rx:::::::*
pulsesecure	pulse_connect_secure	9.0r1	cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r1:::::::*
pulsesecure	pulse_connect_secure	9.0r2	cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r2:::::::*
pulsesecure	pulse_connect_secure	9.0r2.1	cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r2.1:::::::*
pulsesecure	pulse_connect_secure	9.0r3	cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r3:::::::*
pulsesecure	pulse_connect_secure	9.0r3.1	cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0r3.1:::::::*

Rows per page:

1-10 of 441

References

www.securityfocus.com/bid/108073

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/

www.kb.cert.org/vuls/id/927237

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2019-11543