CVE-2020-11581: OS Command Injection
First published: Mon Apr 06 2020(Updated: )
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pulsesecure Pulse Connect Secure | <=2020-04-06 | |
| Apple macOS | ||
| Linux Linux kernel | ||
| Oracle Solaris | ||
| Pulsesecure Pulse Policy Secure |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-11581?
CVE-2020-11581 is a vulnerability in Pulse Secure Pulse Connect Secure (PCS) that allows a man-in-the-middle attacker to perform OS command injection attacks against a client.
What is the severity of CVE-2020-11581?
The severity of CVE-2020-11581 is critical (8.1).
Which software versions are affected by CVE-2020-11581?
Pulse Secure Pulse Connect Secure (PCS) versions up to and including 2020-04-06 are affected by CVE-2020-11581.
How can a man-in-the-middle attacker exploit CVE-2020-11581?
A man-in-the-middle attacker can exploit CVE-2020-11581 by performing OS command injection attacks against a client.
Are macOS, Linux, and Solaris clients vulnerable to CVE-2020-11581?
Yes, macOS, Linux, and Solaris clients are vulnerable to CVE-2020-11581 when a Host Checker policy is enforced.
- collector/nvd-index
- agent/event
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pulsesecure
- canonical/pulsesecure pulse connect secure
- version/pulsesecure pulse connect secure/2020-04-06
- vendor/apple
- canonical/apple macos
- vendor/linux
- canonical/linux linux kernel
- vendor/oracle
- canonical/oracle solaris
- canonical/pulsesecure pulse policy secure