PT-2019-12342 · Pulse Secure · Pulse Connect Secure

Meh Chang + 1 · Published 2019-05-08 · Updated 2024-02-27 · CVE-2019-11508

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure (PCS) versions 8.1R15.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 8.2R12.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 8.3R7.0 and earlier Pulse Secure Pulse Connect Secure (PCS) versions 9.0R3.3 and earlier

Description The issue allows an authenticated attacker, via the admin web interface, to exploit Directory Traversal and execute arbitrary code on the appliance.

Recommendations For versions 8.1R15.0 and earlier, update to version 8.1R15.1 or later. For versions 8.2R12.0 and earlier, update to version 8.2R12.1 or later. For versions 8.3R7.0 and earlier, update to version 8.3R7.1 or later. For versions 9.0R3.3 and earlier, update to version 9.0R3.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-11508

Affected Products

Pulse Connect Secure

References · 11

• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• https://kb.pulsesecure.net/?atype=sa · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11508 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Vendor Advisory
• https://kb.cert.org/vuls/id/927237 · Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Note
• http://securityfocus.com/bid/108073 · Note
• https://t.me/cvenotify/67390 · Telegram Post
• https://t.me/cvenotify/72495 · Telegram Post