« Volver al listado

CVE-2021-22936

Estado: ModificadaMedia (6.1)—

A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Ivanti — Connect SecurePulsesecure — Pulse Connect Secure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22936",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Pulse Connect Secure",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 9.1R12"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-16T19:15:13.627",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Pulse Connect Secure, versiones anteriores a 9.1R12, podría permitir a un actor de amenazas llevar a cabo un ataque de tipo cross-site script contra un administrador autenticado por medio de un parámetro web no digitalizado."
    }
  ],
  "lastModified": "2026-06-17T03:38:03.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F450898-0B06-4073-9B76-BF22F68BD14F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130C8955-BDA4-4518-8EBA-740EB08FC3E4"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AA4B39F-2FB9-4752-B1F1-18812B0990B4"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABD840BF-944E-4F4C-96DC-0256286338F6"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E2D041D-9BDD-416D-B658-1C517C854104"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7155EB34-E8E0-49AF-BDA2-FB4BFA44662E"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25EE614A-5F32-4CA9-998A-4FAF16DC100C"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F49EE829-A2CD-491E-BFC3-7888491D7C58"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2254DDF1-7FF3-49E1-8826-91F49A6794F8"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8EA4DA8-CD09-41AC-ADCB-27CF771C016B"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D6CECCB-18BA-4219-95A2-2525A2BDCE36"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7006C07-0E3F-4890-A1B3-533E10924D49"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43AF1D62-D827-4495-A4B0-CCA0C2BEE68F",
              "versionEndExcluding": "9.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}