PT-2020-13313 · Pulse · Pulse Policy Secure+1

Published 2020-07-27 · Updated 2024-02-27 · CVE-2020-12880

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance versions prior to 9.1R8

Description An issue was discovered in the affected software. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase. This allows access to the entire source code of the appliance, which is otherwise inaccessible due to the appliance's hard disks being encrypted and no root shell being available during normal operation.

Recommendations For Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance versions prior to 9.1R8, update to version 9.1R8 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-12880

Affected Products

Pulse Connect Secure

Pulse Policy Secure

References · 5

• https://kb.pulsesecure.net/?atype=sa · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12880 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12880 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 · Vendor Advisory
• https://t.me/cvenotify/67363 · Telegram Post