JSA10374 - Pulse Connect Secure (PCS) SSL VPN Webroot Path Disclosure Vulnerability

By requesting the 'remediate.cgi' script omitting certain parameters, the embedded PCS web server returns the physical path of the webroot ('/home/webserver/htdocs/') within an "Execute failed" error message Knowing the path does not provide any useful information and does not expose any further security risk to the device.

This issue does not expose any further security risk to the device. Pulse Secure has eliminated the webroot path disclosure in Pulse Secure PCS software version 6.0R1 Build 12023 and higher.