CVE-2020-15352: XEE
Published Oct 27, 2020
·Updated
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Affected Software
52 affected components
PulseSecure Pulse Connect Secure<=9.0
PulseSecure Pulse Connect Secure=9.1
PulseSecure Pulse Connect Secure=9.1-r1
PulseSecure Pulse Connect Secure=9.1-r2
PulseSecure Pulse Connect Secure=9.1-r3
PulseSecure Pulse Connect Secure=9.1-r4
PulseSecure Pulse Connect Secure=9.1-r4.1
PulseSecure Pulse Connect Secure=9.1-r4.2
PulseSecure Pulse Connect Secure=9.1-r4.3
PulseSecure Pulse Connect Secure=9.1-r5
PulseSecure Pulse Connect Secure=9.1-r6
PulseSecure Pulse Connect Secure=9.1-r7
PulseSecure Pulse Connect Secure=9.1-r8
PulseSecure Pulse Connect Secure=9.1-r8.1
PulseSecure Pulse Connect Secure=9.1-r8.2
PulseSecure Pulse Policy Secure<=9.0
PulseSecure Pulse Policy Secure=9.1-r1
PulseSecure Pulse Policy Secure=9.1-r2
PulseSecure Pulse Policy Secure=9.1-r3
PulseSecure Pulse Policy Secure=9.1-r3.1
PulseSecure Pulse Policy Secure=9.1-r4
PulseSecure Pulse Policy Secure=9.1-r4.1
PulseSecure Pulse Policy Secure=9.1-r4.2
PulseSecure Pulse Policy Secure=9.1-r5
PulseSecure Pulse Policy Secure=9.1-r6
PulseSecure Pulse Policy Secure=9.1-r7
PulseSecure Pulse Policy Secure=9.1-r8
Ivanti Connect Secure=9.1
Ivanti Connect Secure=9.1-r1
Ivanti Connect Secure=9.1-r2
Ivanti Connect Secure=9.1-r3
Ivanti Connect Secure=9.1-r4
Ivanti Connect Secure=9.1-r4.1
Ivanti Connect Secure=9.1-r4.2
Ivanti Connect Secure=9.1-r4.3
Ivanti Connect Secure=9.1-r5
Ivanti Connect Secure=9.1-r6
Ivanti Connect Secure=9.1-r7
Ivanti Connect Secure=9.1-r8
Ivanti Connect Secure=9.1-r8.1
Ivanti Connect Secure=9.1-r8.2
Ivanti Policy Secure=9.1-r1
Ivanti Policy Secure=9.1-r2
Ivanti Policy Secure=9.1-r3
Ivanti Policy Secure=9.1-r3.1
Ivanti Policy Secure=9.1-r4
Ivanti Policy Secure=9.1-r4.1
Ivanti Policy Secure=9.1-r4.2
Ivanti Policy Secure=9.1-r5
Ivanti Policy Secure=9.1-r6
Ivanti Policy Secure=9.1-r7
Ivanti Policy Secure=9.1-r8
Event History
Oct 27, 2020
CVE Published
via MITRE·04:10 AM
Data Sourced
via MITRE·04:10 AM
Description
Frequently Asked Questions
1
What is CVE-2020-15352?
CVE-2020-15352 is an XML external entity (XXE) vulnerability in Pulse Connect Secure and Pulse Policy Secure.
2
How does CVE-2020-15352 impact Pulse Connect Secure and Pulse Policy Secure?
CVE-2020-15352 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
3
What is the severity of CVE-2020-15352?
CVE-2020-15352 has a severity score of 7.2 (high).
4
Which versions of Pulse Connect Secure are affected by CVE-2020-15352?
Pulse Connect Secure versions before 9.1R9 are affected by CVE-2020-15352.
5
How can I mitigate CVE-2020-15352 in Pulse Connect Secure and Pulse Policy Secure?
Updating Pulse Connect Secure and Pulse Policy Secure to version 9.1R9 or later will mitigate the vulnerability.