VulnerabilityModified

CVE-2017-11193

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi.

HIGH 8.8EPSS 0.56%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.

CVSS 3.0: 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.56% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: pulsesecure/pulse connect secure
Source: cve@mitre.org

References

http://www.securityfocus.com/bid/99621
http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdfThird Party Advisory
https://twitter.com/sxcurity/status/884556905145937921Third Party Advisory
http://www.securityfocus.com/bid/99621
http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdfThird Party Advisory
https://twitter.com/sxcurity/status/884556905145937921Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.