CVE-2020-8260: Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Other sources
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-8260?
CVE-2020-8260 is a code execution vulnerability in the Ivanti Pulse Connect Secure admin web interface.
Who is affected by CVE-2020-8260?
The vulnerability affects Ivanti Pulse Connect Secure versions < 9.1R9 and Pulse Secure Desktop Client 9.1 on Linux.
What is the severity of CVE-2020-8260?
CVE-2020-8260 has a severity score of 7.2, which is considered high.
How can an attacker exploit CVE-2020-8260?
An authenticated attacker can exploit CVE-2020-8260 to perform arbitrary code execution using uncontrolled gzip extraction.
How can I fix CVE-2020-8260?
To fix CVE-2020-8260, update Ivanti Pulse Connect Secure to version 9.1R9 or later, and update Pulse Secure Desktop Client to a non-vulnerable version.