PT-2019-12342 · Pulse Secure · Pulse Connect Secure

Meh Chang + 1 · Publicado 2019-05-08 · Atualizado 2024-02-27 · CVE-2019-11508

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure (PCS) versions 8.1R15.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 8.2R12.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 8.3R7.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 9.0R3.3 and earlier

Description The issue allows an authenticated attacker, via the admin web interface, to exploit Directory Traversal and execute arbitrary code on the appliance.

Recommendations For versions 8.1R15.0 and earlier, update to version 8.1R15.1 or later. For versions 8.2R12.0 and earlier, update to version 8.2R12.1 or later. For versions 8.3R7.0 and earlier, update to version 8.3R7.1 or later. For versions 9.0R3.3 and earlier, update to version 9.0R3.4 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-11508

Produtos afetados

Pulse Connect Secure

Referências · 11

• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• https://kb.pulsesecure.net/?atype=sa · Aviso do Fabricante
• https://kb.cert.org/vuls/id/927237 · Nota
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Nota
• http://securityfocus.com/bid/108073 · Nota
• https://osv.dev/vulnerability/CVE-2019-11508 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11508 · Nota de Segurança
• https://t.me/cvenotify/67390 · Publicação no Telegram
• https://t.me/cvenotify/72495 · Publicação no Telegram
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Aviso do Fabricante