Vulnerability Description
A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pulsesecure | Pulse Connect Secure | < 8.0r17.0 |
Related Weaknesses (CWE)
References
- http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018PatchVendor Advisory
- http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018PatchVendor Advisory
FAQ
What is CVE-2017-17947?
CVE-2017-17947 is a vulnerability with a CVSS score of 4.8 (MEDIUM). A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Poli...
How severe is CVE-2017-17947?
CVE-2017-17947 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-17947?
Check the references section above for vendor advisories and patch information. Affected products include: Pulsesecure Pulse Connect Secure.