Pulse Secure Pulse Connect Secure CVE-2018-20808 Cross Site Scripting Vulnerability

Bugtraq ID:	109346
Class:	Input Validation Error
CVE:	CVE-2018-20808
Remote:	Yes
Local:	No
Published:	Jun 28 2019 12:00AM
Updated:	Jun 28 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Pulse Secure Pulse Connect Secure 8.3R2 Pulse Secure Pulse Connect Secure 8.3R1
Not Vulnerable:	Pulse Secure Pulse Connect Secure 8.3R3

Pulse Secure Pulse Connect Secure CVE-2018-20808 Cross Site Scripting Vulnerability

Pulse Secure Pulse Connect Secure is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pulse Secure Pulse Connect Secure 8.3RX prior to 8.3R3 are vulnerable.

Pulse Secure Pulse Connect Secure CVE-2018-20808 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Pulse Secure Pulse Connect Secure CVE-2018-20808 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pulse Secure Pulse Connect Secure CVE-2018-20808 Cross Site Scripting Vulnerability

References:

• Pulse Secure - Homepage (Pulse Secure)
  
• Security Advisories (Pulse Secure)