CVE-2020-8240
First published: Wed Oct 28 2020(Updated: )
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the Credential Provider.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pulsesecure Pulse Secure Desktop Client | <9.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r2 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r3 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r3.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4.2 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r5 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r6 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r7 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r7.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r8 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this Pulse Secure Desktop Client vulnerability?
The vulnerability ID is CVE-2020-8240.
What is the severity rating of CVE-2020-8240?
The severity rating of CVE-2020-8240 is 7.8 (High).
Which software versions are affected by CVE-2020-8240?
Pulse Secure Desktop Client versions up to and including 9.1R8.2 are affected.
How can a restricted user exploit CVE-2020-8240?
A restricted user with the Embedded Browser configured with Credential Provider can use system-level privileges.
Is CVE-2020-8240 only applicable to Windows PDC?
Yes, CVE-2020-8240 only affects Windows PDC if the Embedded Browser is configured with Credential Provider.
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pulsesecure
- canonical/pulsesecure pulse secure desktop client
- version/pulsesecure pulse secure desktop client/9.1-r1
- version/pulsesecure pulse secure desktop client/9.1-r2
- version/pulsesecure pulse secure desktop client/9.1-r3
- version/pulsesecure pulse secure desktop client/9.1-r3.1
- version/pulsesecure pulse secure desktop client/9.1-r4
- version/pulsesecure pulse secure desktop client/9.1-r4.1
- version/pulsesecure pulse secure desktop client/9.1-r4.2
- version/pulsesecure pulse secure desktop client/9.1-r5
- version/pulsesecure pulse secure desktop client/9.1-r6
- version/pulsesecure pulse secure desktop client/9.1-r7
- version/pulsesecure pulse secure desktop client/9.1-r7.1
- version/pulsesecure pulse secure desktop client/9.1-r8
- version/pulsesecure pulse secure desktop client/9.1-r8.2