PT-2019-12191 · Pulse · Pulse Connect Secure+1

CVE-2019-11213 · Publicado 2019-04-12 · Atualizado 2024-02-27

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pulse Desktop Client versions 5.x through 5.3R6 Pulse Desktop Client versions 9.x through 9.0R2 Pulse Connect Secure versions 8.1 through 8.1R13 Pulse Connect Secure versions 8.3 through 8.3R6 Pulse Connect Secure versions 9.0 through 9.0R2

Description An issue allows an attacker to access session tokens, potentially enabling them to replay and spoof sessions, and gain unauthorized access as an end user. The endpoint must already be compromised for exploitation to succeed.

Recommendations For Pulse Desktop Client versions 5.x through 5.3R6, update to Secure Desktop 5.3R7 or later. For Pulse Desktop Client versions 9.x through 9.0R2, update to Secure Desktop 9.0R3 or later. For Pulse Connect Secure versions 8.1 through 8.1R13, update to 8.1R14 or later. For Pulse Connect Secure versions 8.3 through 8.3R6, update to 8.3R7 or later. For Pulse Connect Secure versions 9.0 through 9.0R2, update to 9.0R3 or later.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2019-11213

Produtos afetados

Pulse Connect Secure

Pulse Desktop Client

Referências · 5

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44114 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11213 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/192371 · Nota
• https://t.me/cvenotify/72498 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-11213 · Nota de Segurança