CVE-2017-11196 | BDVDB-2026-87576 Detail

Description#

Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://twitter.com/sxcurity/status/884556905145937921
http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf
http://www.securityfocus.com/bid/99613

Exploit#

No public exploit known

History#

Version 12017-07-12Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.