CVE-2021-22936

MEDIUM

Pulse Connect Secure < 9.1R12 - Cross-Site Scripting via Unsanitized Web Parameter

Title source: llm

Description

A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC

Scores

CVSS v3 6.1

EPSS 0.0012

EPSS Percentile 30.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

ivanti/connect_secure 9.1 (12 CPE variants)

pulsesecure/pulse_connect_secure < 9.1

Published Aug 16, 2021

Tracked Since Feb 18, 2026