CVE-2021-31922: High severity pulse secure virtual traffic manager vulnerability
Published May 14, 2021
·Updated
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
Affected Software
11 affected components
PulseSecure Virtual Traffic Manager<=18.1
PulseSecure Virtual Traffic Manager>=18.3<=19.1
PulseSecure Virtual Traffic Manager=18.2
PulseSecure Virtual Traffic Manager=18.2-r1
PulseSecure Virtual Traffic Manager=19.2
PulseSecure Virtual Traffic Manager=19.2-r1
PulseSecure Virtual Traffic Manager=19.2-r2
PulseSecure Virtual Traffic Manager=19.3
PulseSecure Virtual Traffic Manager=20.1
PulseSecure Virtual Traffic Manager=20.2
PulseSecure Virtual Traffic Manager=20.3
Remediation
Event History
May 14, 2021
CVE Published
via MITRE·12:41 AM
Data Sourced
via MITRE·12:41 AM
Description
Frequently Asked Questions
1
What is CVE-2021-31922?
CVE-2021-31922 is an HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1.
2
How does CVE-2021-31922 work?
CVE-2021-31922 allows an attacker to smuggle an HTTP request through an HTTP/2 Header.
3
What is the severity of CVE-2021-31922?
CVE-2021-31922 has a severity level of 7.5 (high).
4
Which versions of Pulse Secure Virtual Traffic Manager are affected by CVE-2021-31922?
Pulse Secure Virtual Traffic Manager versions before 21.1 are affected by CVE-2021-31922.
5
How can I resolve CVE-2021-31922?
CVE-2021-31922 is resolved in Pulse Secure Virtual Traffic Manager versions 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.