CVE-2022-21826

Pulse Secure versions 9.115 and below ignore the Content-Length header in POST requests, leaving leftover data on the connection that gets prepended to the next HTTP request. An attacker can exploit this to inject malicious content into a subsequent request, potentially leading to XSS attacks in a user's browser.

HTTP request smuggling vulnerability in Pulse Secure ≤9.115 caused by improper handling of Content-Length headers in POST requests, allowing attacker-controlled data to persist on the TLS socket and prefix subsequent requests. Attack vector requires victim to visit attacker-controlled website that triggers a cross-origin POST, with impact of potential XSS execution in the victim's browser context.