First published: Thu Jul 30 2020(Updated: )
A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
Credit: support@hackerone.com support@hackerone.com support@hackerone.com
Affected Software | Affected Version | How to fix |
---|---|---|
Pulsesecure Pulse Connect Secure | <=9.0 | |
Pulsesecure Pulse Connect Secure | =9.1 | |
Pulsesecure Pulse Connect Secure | =9.1-r1 | |
Pulsesecure Pulse Connect Secure | =9.1-r2 | |
Pulsesecure Pulse Connect Secure | =9.1-r3 | |
Pulsesecure Pulse Connect Secure | =9.1-r4 | |
Pulsesecure Pulse Connect Secure | =9.1-r4.1 | |
Pulsesecure Pulse Connect Secure | =9.1-r4.2 | |
Pulsesecure Pulse Connect Secure | =9.1-r4.3 | |
Pulsesecure Pulse Connect Secure | =9.1-r5 | |
Pulsesecure Pulse Connect Secure | =9.1-r6 | |
Pulsesecure Pulse Connect Secure | =9.1-r7 | |
Pulsesecure Pulse Policy Secure | <=9.0 | |
Pulsesecure Pulse Policy Secure | =9.1 | |
Pulsesecure Pulse Policy Secure | =9.1-r1 | |
Pulsesecure Pulse Policy Secure | =9.1-r2 | |
Pulsesecure Pulse Policy Secure | =9.1-r3 | |
Pulsesecure Pulse Policy Secure | =9.1-r3.1 | |
Pulsesecure Pulse Policy Secure | =9.1-r4 | |
Pulsesecure Pulse Policy Secure | =9.1-r4.1 | |
Pulsesecure Pulse Policy Secure | =9.1-r4.2 | |
Pulsesecure Pulse Policy Secure | =9.1-r5 | |
Pulsesecure Pulse Policy Secure | =9.1-r6 | |
Pulsesecure Pulse Policy Secure | =9.1-r7 | |
Pulse Secure Pulse Connect Secure | ||
Ivanti Connect Secure | =9.1 | |
Ivanti Connect Secure | =9.1-r1 | |
Ivanti Connect Secure | =9.1-r2 | |
Ivanti Connect Secure | =9.1-r3 | |
Ivanti Connect Secure | =9.1-r4 | |
Ivanti Connect Secure | =9.1-r4.1 | |
Ivanti Connect Secure | =9.1-r4.2 | |
Ivanti Connect Secure | =9.1-r4.3 | |
Ivanti Connect Secure | =9.1-r5 | |
Ivanti Connect Secure | =9.1-r6 | |
Ivanti Connect Secure | =9.1-r7 | |
Ivanti Policy Secure | =9.1 | |
Ivanti Policy Secure | =9.1-r1 | |
Ivanti Policy Secure | =9.1-r2 | |
Ivanti Policy Secure | =9.1-r3 | |
Ivanti Policy Secure | =9.1-r3.1 | |
Ivanti Policy Secure | =9.1-r4 | |
Ivanti Policy Secure | =9.1-r4.1 | |
Ivanti Policy Secure | =9.1-r4.2 | |
Ivanti Policy Secure | =9.1-r5 | |
Ivanti Policy Secure | =9.1-r6 | |
Ivanti Policy Secure | =9.1-r7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-8218 is a code injection vulnerability in Pulse Connect Secure <9.1R8 that allows an attacker to execute arbitrary code.
The severity of CVE-2020-8218 is rated as high with a CVSS score of 7.2.
Pulse Connect Secure versions up to 9.1R8 are affected by CVE-2020-8218.
An attacker can exploit CVE-2020-8218 by crafting a URI to perform an arbitrary code execution via the admin web interface.
You can find more information about CVE-2020-8218 at the following references: [Pulse Secure Advisory](https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516) and [GoSecure Blog](https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/).