CVE-2016-4789 — Cross-site Scripting in Ivanti Connect Secure

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

6.1MEDIUMNVD

EPSS

0.1%

top 74.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ivanti Connect Secure Pulsesecure Pulse Connect Secure

Timeline

PublishedMay 26

Latest updateMay 13

Description

Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDpulsesecure/pulse_connect_secure7.4, 8.1r1.0+1

▶NVDivanti/connect_secure8.0, 8.1, 8.2+2

🔴Vulnerability Details

GHSA

GHSA-pcqx-86vv-4gxg: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8↗2022-05-13

▶

CVEList

CVE-2016-4789: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8↗2016-05-26

▶