CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. Its EPSS score suggests a 45.2% probability of exploitation in the next 30 days.
CVE
CVE-2022-21826
Severity
MEDIUM
CVSS
5.4
EPSS
45.23%
Original NVD Description
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
Related CVEs
Other vulnerabilities affecting the same vendor(s)