Vulnerability Description
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Connect Secure | 9.1 |
| Pulsesecure | Pulse Connect Secure | < 9.1 |
Related Weaknesses (CWE)
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-DesyncVendor Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-DesyncVendor Advisory
FAQ
What is CVE-2022-21826?
CVE-2022-21826 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves t...
How severe is CVE-2022-21826?
CVE-2022-21826 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-21826?
Check the references section above for vendor advisories and patch information. Affected products include: Ivanti Connect Secure, Pulsesecure Pulse Connect Secure.