PT-2019-12362 · Pulse · Pulse Connect Secure

Published 2019-04-26 · Updated 2024-02-27 · CVE-2019-11538

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions 9.0RX before 9.0R3.4 Pulse Connect Secure versions 8.3RX before 8.3R7.1 Pulse Connect Secure versions 8.2RX before 8.2R12.1 Pulse Connect Secure versions 8.1RX before 8.1R15.1

Description An NFS problem could allow an authenticated attacker to access the contents of arbitrary files on the affected device.

Recommendations For Pulse Connect Secure version 9.0RX, update to version 9.0R3.4 or later. For Pulse Connect Secure version 8.3RX, update to version 8.3R7.1 or later. For Pulse Connect Secure version 8.2RX, update to version 8.2R12.1 or later. For Pulse Connect Secure version 8.1RX, update to version 8.1R15.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-11538

Affected Products

Pulse Connect Secure

References · 11

• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11538 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11538 · Vendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Note
• https://kb.cert.org/vuls/id/927237 · Note
• https://t.me/cvenotify/46791 · Telegram Post
• http://securityfocus.com/bid/108073 · Note
• https://t.me/cvenotify/67388 · Telegram Post
• https://t.me/cvenotify/72488 · Telegram Post