« Volver al listado

CVE-2020-8263

Estado: ModificadaMedia (5.4)—

A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pulsesecure — Pulse Secure Desktop Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8263",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Pulse Connect Secure / Pulse Policy Secure",
          "versions": [
            {
              "status": "affected",
              "version": "9.1R9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-28T13:15:13.293",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de usuario web autenticado de Pulse Connect Secure versiones anteriores a 9.1R9, podría permitir a atacantes conducir ataques de tipo Cross-Site Scripting (XSS) por medio del archivo CGI"
    }
  ],
  "lastModified": "2026-06-17T03:26:09.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87BF5FC6-3D85-4C88-AD32-23A1BB4975A8",
              "versionEndExcluding": "9.1"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r1:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "524B043E-80B3-4E60-BDDB-55A29A04DA1D"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r2:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E79BF74-D489-4A8D-8135-E5427D43DE2A"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71C518EF-BFF6-41EE-A696-311E6EB3C17D"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.1:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0840530-B0F7-4BBA-BC55-4BF2C2D59DF0"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F98E7F0-6D2D-4238-BABF-15841BE32605"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.1:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB616A5D-8B22-4C0D-8E09-073B4778430E"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.2:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40E3E61D-0716-408A-BBF6-6336FED8F618"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r5:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F066817-5364-47F5-9211-9F4FDD958BD3"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r6:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "661A0EB6-4CCC-4744-B0E9-81A0E3E2BB37"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEB6A361-FD3C-4263-92E2-B2DBCDE20674"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7.1:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C64CBA6-AAD2-4151-BE72-4F68934D94BA"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r8:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BAFB239-5C78-4F3D-9CDA-D67A74B2AF05"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r8.2:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A0DDA55-66D2-43A1-AEB2-26192150DC83"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}