PT-2020-20064 · Pulse · Pulse Connect Secure

Jean-Frédéric Gauron + 5 · Published 2020-09-29 · Updated 2024-02-27 · CVE-2020-8256

Positive Technologies · (AI Summary)

CVSS v2.0

4.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

Pulse Connect Secure versions prior to 9.1R8.2

Description:

A vulnerability in the Pulse Connect Secure admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.

Recommendations:

For versions prior to 9.1R8.2, update to version 9.1R8.2 or later to resolve the issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-8256

Affected Products

Pulse Connect Secure

References · 5

• 🔥 https://gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8256 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2108 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8256 · Note