CVE-2022-21826 - Vulnerability Details

Vendors	Products
Ivanti	Connect Secure
Pulsesecure	Pulse Connect Secure

Link	Providers
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Pulse Connect Secure VPN Server", "vendor": "n/a", "versions": [{"status": "affected", "version": "9.1R14 and below"}]}], "descriptions": [{"lang": "en", "value": "Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "HTTP Request Smuggling (CWE-444)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-30T16:24:25", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2022-21826", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Pulse Connect Secure VPN Server", "version": {"version_data": [{"version_value": "9.1R14 and below"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "HTTP Request Smuggling (CWE-444)"}]}]}, "references": {"reference_data": [{"name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/", "refsource": "MISC", "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T02:53:36.293Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2022-21826", "datePublished": "2022-09-30T16:24:25", "dateReserved": "2021-12-10T00:00:00", "dateUpdated": "2024-08-03T02:53:36.293Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Pulse Connect Secure VPN Server (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : 9.1R14 and below (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-444 (string)

description : HTTP Request Smuggling (CWE-444) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-09-30T16:24:25 (string)

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : support@hackerone.com (string)

ID : CVE-2022-21826 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Pulse Connect Secure VPN Server (string)

version : { »

version_data : [ »

0 : { »

version_value : 9.1R14 and below (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : HTTP Request Smuggling (CWE-444) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

refsource : MISC (string)

url : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T02:53:36.293Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

assignerShortName : hackerone (string)

cveId : CVE-2022-21826 (string)

datePublished : 2022-09-30T16:24:25 (string)

dateReserved : 2021-12-10T00:00:00 (string)

dateUpdated : 2024-08-03T02:53:36.293Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*", "matchCriteriaId": "4F450898-0B06-4073-9B76-BF22F68BD14F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*", "matchCriteriaId": "4B21C181-DC49-4EBD-9932-DBB337151FF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*", "matchCriteriaId": "130C8955-BDA4-4518-8EBA-740EB08FC3E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*", "matchCriteriaId": "5AA4B39F-2FB9-4752-B1F1-18812B0990B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*", "matchCriteriaId": "232BAB6C-D318-4F80-8F49-4E700C21F535", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*", "matchCriteriaId": "ABD840BF-944E-4F4C-96DC-0256286338F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*", "matchCriteriaId": "A1995F34-AE75-47C4-9A9D-DBB1D3E130E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*", "matchCriteriaId": "366EF5B8-0233-49B8-806A-E54F60410ADE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*", "matchCriteriaId": "6F2A7F5C-1D78-4D19-B8ED-5822FDF5DA63", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*", "matchCriteriaId": "32E0B425-A9BA-4D00-84A9-46268072D696", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*", "matchCriteriaId": "BBC724E8-195B-4CB4-AC2A-63E184AED4F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:*", "matchCriteriaId": "7162C24D-D181-49CC-B8C2-9EE3E0CDF846", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*", "matchCriteriaId": "65435A96-EF7A-439A-AA6C-CB7EAEF0A963", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*", "matchCriteriaId": "CE228FBD-5AD1-4BC6-AF63-5248E671B04F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*", "matchCriteriaId": "4FEFC4B1-7350-46F9-80C1-42F5AE06142F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:*", "matchCriteriaId": "4E2D041D-9BDD-416D-B658-1C517C854104", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*", "matchCriteriaId": "DB7A6D62-6576-4713-9BF4-11068A72E8B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:*", "matchCriteriaId": "7155EB34-E8E0-49AF-BDA2-FB4BFA44662E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*", "matchCriteriaId": "843BC1B9-50CC-4F8F-A454-A0CEC6E92290", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:*", "matchCriteriaId": "25EE614A-5F32-4CA9-998A-4FAF16DC100C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*", "matchCriteriaId": "D5355372-03EA-46D7-9104-A2785C29B664", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*", "matchCriteriaId": "3DE32A0C-8944-4F51-A286-266055CA4B2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*", "matchCriteriaId": "0349A0CC-A372-4E51-899E-D7BA67876F4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*", "matchCriteriaId": "93D1A098-BD77-4A7B-9070-A764FB435981", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:*", "matchCriteriaId": "F49EE829-A2CD-491E-BFC3-7888491D7C58", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*", "matchCriteriaId": "3CCC2D7B-F835-45EC-A316-2F0C5F2CF565", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:*", "matchCriteriaId": "2254DDF1-7FF3-49E1-8826-91F49A6794F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*", "matchCriteriaId": "AD812596-C77C-4129-982F-C22A25B52126", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:*", "matchCriteriaId": "B8EA4DA8-CD09-41AC-ADCB-27CF771C016B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*", "matchCriteriaId": "9FA0B20D-3FA1-42AE-BDC5-93D8A182927C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:*", "matchCriteriaId": "4D6CECCB-18BA-4219-95A2-2525A2BDCE36", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*", "matchCriteriaId": "BFFA0B02-7F6D-4434-B1E7-EB8520FD68A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*", "matchCriteriaId": "DFE8FA87-9622-4D5B-99C7-D8EE230C0AA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*", "matchCriteriaId": "07AB853D-5A3F-4142-8417-1C9FB729A89E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*", "matchCriteriaId": "16DAA769-8F0D-4C54-A8D9-9902995605B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:*", "matchCriteriaId": "B7006C07-0E3F-4890-A1B3-533E10924D49", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*", "matchCriteriaId": "B2C10C89-1DBC-4E91-BD28-D5097B589CA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*", "matchCriteriaId": "F54753D0-6275-4F82-B874-55438D2983B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*", "matchCriteriaId": "43AF1D62-D827-4495-A4B0-CCA0C2BEE68F", "versionEndExcluding": "9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS."}, {"lang": "es", "value": "Pulse Secure versiones 9.115,y anteriores, pueden ser susceptibles de contrabando de peticiones http del lado del cliente, cuando la aplicaci\u00f3n recibe una petici\u00f3n POST, ignora el encabezado Content-Length de la petici\u00f3n y deja el cuerpo del POST en el socket TCP/TLS. Este cuerpo termina prefijando la siguiente petici\u00f3n HTTP enviada por esa conexi\u00f3n, esto significa que cuando alguien carga el sitio web el atacante puede ser capaz de hacer que el navegador emita un POST a la aplicaci\u00f3n, permitiendo un ataque de tipo XSS"}], "id": "CVE-2022-21826", "lastModified": "2024-11-21T06:45:30.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-30T17:15:12.183", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "support@hackerone.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-444"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* (string)

matchCriteriaId : 4F450898-0B06-4073-9B76-BF22F68BD14F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* (string)

matchCriteriaId : 4B21C181-DC49-4EBD-9932-DBB337151FF7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:* (string)

matchCriteriaId : 130C8955-BDA4-4518-8EBA-740EB08FC3E4 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:* (string)

matchCriteriaId : 5AA4B39F-2FB9-4752-B1F1-18812B0990B4 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:* (string)

matchCriteriaId : 232BAB6C-D318-4F80-8F49-4E700C21F535 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:* (string)

matchCriteriaId : ABD840BF-944E-4F4C-96DC-0256286338F6 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:* (string)

matchCriteriaId : A1995F34-AE75-47C4-9A9D-DBB1D3E130E5 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* (string)

matchCriteriaId : 366EF5B8-0233-49B8-806A-E54F60410ADE (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* (string)

matchCriteriaId : 6F2A7F5C-1D78-4D19-B8ED-5822FDF5DA63 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* (string)

matchCriteriaId : 32E0B425-A9BA-4D00-84A9-46268072D696 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:* (string)

matchCriteriaId : BBC724E8-195B-4CB4-AC2A-63E184AED4F6 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:* (string)

matchCriteriaId : 7162C24D-D181-49CC-B8C2-9EE3E0CDF846 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* (string)

matchCriteriaId : 65435A96-EF7A-439A-AA6C-CB7EAEF0A963 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:* (string)

matchCriteriaId : CE228FBD-5AD1-4BC6-AF63-5248E671B04F (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:* (string)

matchCriteriaId : 4FEFC4B1-7350-46F9-80C1-42F5AE06142F (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:* (string)

matchCriteriaId : 4E2D041D-9BDD-416D-B658-1C517C854104 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:* (string)

matchCriteriaId : DB7A6D62-6576-4713-9BF4-11068A72E8B7 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:* (string)

matchCriteriaId : 7155EB34-E8E0-49AF-BDA2-FB4BFA44662E (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:* (string)

matchCriteriaId : 843BC1B9-50CC-4F8F-A454-A0CEC6E92290 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:* (string)

matchCriteriaId : 25EE614A-5F32-4CA9-998A-4FAF16DC100C (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:* (string)

matchCriteriaId : D5355372-03EA-46D7-9104-A2785C29B664 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:* (string)

matchCriteriaId : 3DE32A0C-8944-4F51-A286-266055CA4B2F (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:* (string)

matchCriteriaId : 0349A0CC-A372-4E51-899E-D7BA67876F4B (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:* (string)

matchCriteriaId : 93D1A098-BD77-4A7B-9070-A764FB435981 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:* (string)

matchCriteriaId : F49EE829-A2CD-491E-BFC3-7888491D7C58 (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:* (string)

matchCriteriaId : 3CCC2D7B-F835-45EC-A316-2F0C5F2CF565 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:* (string)

matchCriteriaId : 2254DDF1-7FF3-49E1-8826-91F49A6794F8 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:* (string)

matchCriteriaId : AD812596-C77C-4129-982F-C22A25B52126 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:* (string)

matchCriteriaId : B8EA4DA8-CD09-41AC-ADCB-27CF771C016B (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:* (string)

matchCriteriaId : 9FA0B20D-3FA1-42AE-BDC5-93D8A182927C (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:* (string)

matchCriteriaId : 4D6CECCB-18BA-4219-95A2-2525A2BDCE36 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:* (string)

matchCriteriaId : BFFA0B02-7F6D-4434-B1E7-EB8520FD68A0 (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:* (string)

matchCriteriaId : DFE8FA87-9622-4D5B-99C7-D8EE230C0AA9 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:* (string)

matchCriteriaId : 07AB853D-5A3F-4142-8417-1C9FB729A89E (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:* (string)

matchCriteriaId : 16DAA769-8F0D-4C54-A8D9-9902995605B0 (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:* (string)

matchCriteriaId : B7006C07-0E3F-4890-A1B3-533E10924D49 (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:* (string)

matchCriteriaId : B2C10C89-1DBC-4E91-BD28-D5097B589CA9 (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:* (string)

matchCriteriaId : F54753D0-6275-4F82-B874-55438D2983B3 (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 43AF1D62-D827-4495-A4B0-CCA0C2BEE68F (string)

versionEndExcluding : 9.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. (string)

}

1 : { »

lang : es (string)

value : Pulse Secure versiones 9.115,y anteriores, pueden ser susceptibles de contrabando de peticiones http del lado del cliente, cuando la aplicación recibe una petición POST, ignora el encabezado Content-Length de la petición y deja el cuerpo del POST en el socket TCP/TLS. Este cuerpo termina prefijando la siguiente petición HTTP enviada por esa conexión, esto significa que cuando alguien carga el sitio web el atacante puede ser capaz de hacer que el navegador emita un POST a la aplicación, permitiendo un ataque de tipo XSS (string)

}

]

id : CVE-2022-21826 (string)

lastModified : 2024-11-21T06:45:30.770 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.3 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-09-30T17:15:12.183 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/ (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-444 (string)

}

]

source : support@hackerone.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-444 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object