CVE-2019-11507
MEDIUM EXPLOITED RANSOMWARE NUCLEIPulse Connect Secure 8.3.x < 8.3R7.1 and 9.0.x < 9.0R3 - Cross-Site Scripting on Application Launcher Page
Title source: llmExploitation Summary
CVE-2019-11507 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. A Nuclei detection template is also available.
Description
In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.
Nuclei Templates (1)
Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)
MEDIUMby theamanrawat
Shodan:
http.html:"welcome.cgi?p=logo" || http.title:"ivanti connect secure"
FOFA:
body="welcome.cgi?p=logo" || title="ivanti connect secure"
References (7)
Core 7
Core References
Third Party Advisory, Vendor Advisory x_refsource_misc
https://kb.pulsesecure.net/?atype=sa
Patch, Vendor Advisory x_refsource_confirm
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
Broken Link, Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/108073
Exploit, Third Party Advisory x_refsource_misc
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
Exploit, Third Party Advisory x_refsource_misc
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/927237
Third Party Advisory x_refsource_confirm
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
Scores
CVSS v3
6.1
EPSS
0.0406
EPSS Percentile
89.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
VulnCheck KEV
2020-06-08
Ransomware Use
Confirmed
CWE
CWE-79
Status
published
Products (2)
ivanti/connect_secure
8.3 r1 (12 CPE variants)
ivanti/connect_secure
9.0 r1 (3 CPE variants)
Published
May 08, 2019
Tracked Since
Feb 18, 2026