high8.8
CVE-2017-11196
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi.
Impact
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pulsesecure | Pulse Connect Secure | Version 8.3r1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/99613
- http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf
- https://twitter.com/sxcurity/status/884556905145937921
- http://www.securityfocus.com/bid/99613
- http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf
- https://twitter.com/sxcurity/status/884556905145937921