PT-2019-10249 · Pulse · Pulse Connect Secure+1

Published 2019-03-16 · Updated 2024-02-27 · CVE-2018-20810

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure (PCS) versions 8.3RX through 8.3R1 Pulse Policy Secure (PPS) versions 5.4RX through 5.4R1

Description: The issue concerns the lack of proper encryption for session data between cluster nodes during cluster synchronization.

Recommendations: For Pulse Connect Secure (PCS) versions 8.3RX through 8.3R1, update to version 8.3R2 or later. For Pulse Policy Secure (PPS) versions 5.4RX through 5.4R1, update to version 5.4R2 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2018-20810

Affected Products

Pulse Connect Secure

Pulse Policy Secure

References · 3

• https://osv.dev/vulnerability/CVE-2018-20810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20810 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 · Vendor Advisory