Medium severity · published Apr 26, 2019
CVE-2019-11543
XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX…
6.1
CVSS
3.1%
EPSS
No
On KEV
Description
XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Connect Secure · Ivanti
8.1; 8.3 · source: NVD
PC
Pulse Connect Secure · Pulsesecure
8.1r1.0; 8.1rx; 8.3rx; 9.0r1; 9.0r2; 9.0r2.1; +4 more · source: NVD
PP
Pulse Policy Secure · Pulsesecure
5.2r1.0; 5.2r2.0; 5.2r3.0; 5.2r3.2; 5.2r4.0; 5.2r5.0; +26 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11543
Broken Link
http://www.securityfocus.com/bid/108073
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
Third Party Advisory
https://www.kb.cert.org/vuls/id/927237
More from Connect Secure
10.0
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability