CVE-2021-22937: Malicious File Upload
Published Aug 16, 2021
·Updated
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
Affected Software
25 affected components
PulseSecure Pulse Connect Secure<9.1
PulseSecure Pulse Connect Secure=9.1
PulseSecure Pulse Connect Secure=9.1-r1.0
PulseSecure Pulse Connect Secure=9.1-r10.0
PulseSecure Pulse Connect Secure=9.1-r11.0
PulseSecure Pulse Connect Secure=9.1-r2.0
PulseSecure Pulse Connect Secure=9.1-r3.0
PulseSecure Pulse Connect Secure=9.1-r4.0
PulseSecure Pulse Connect Secure=9.1-r5.0
PulseSecure Pulse Connect Secure=9.1-r6.0
PulseSecure Pulse Connect Secure=9.1-r7.0
PulseSecure Pulse Connect Secure=9.1-r8.0
PulseSecure Pulse Connect Secure=9.1-r9.0
Ivanti Connect Secure=9.1
Ivanti Connect Secure=9.1-r1.0
Ivanti Connect Secure=9.1-r10.0
Ivanti Connect Secure=9.1-r11.0
Ivanti Connect Secure=9.1-r2.0
Ivanti Connect Secure=9.1-r3.0
Ivanti Connect Secure=9.1-r4.0
Ivanti Connect Secure=9.1-r5.0
Ivanti Connect Secure=9.1-r6.0
Ivanti Connect Secure=9.1-r7.0
Ivanti Connect Secure=9.1-r8.0
Ivanti Connect Secure=9.1-r9.0
Event History
Aug 16, 2021
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22937?
The severity of CVE-2021-22937 is high with a CVSS score of 7.2.
2
How does CVE-2021-22937 affect Pulse Connect Secure?
CVE-2021-22937 affects Pulse Connect Secure versions before 9.1R12, allowing an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
3
How can I fix CVE-2021-22937?
To fix CVE-2021-22937, upgrade Pulse Connect Secure to version 9.1R12 or a later version.
4
Where can I find more information about CVE-2021-22937?
You can find more information about CVE-2021-22937 in the Pulse Secure Security Advisory SA44858.
5
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-22937?
The Common Weakness Enumeration (CWE) ID for CVE-2021-22937 is 434.