CVE-2018-20306

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.

Affected products

Pulsesecure Virtual Traffic Manager: from 9.9 before 9.9r2; from 10.4 before 10.4r1; from 17.2 before 17.2r1 — fixed in 10.4r1, 17.2r1, 9.9r2

How to fix

Upgrade to a fixed version: Pulsesecure Virtual Traffic Manager 10.4r1, 17.2r1, 9.9r2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-20306 or the next vulnerability affects your stack