PT-2020-6456 · Pulse · Pulse Connect Secure

Published 2020-09-29 · Updated 2024-02-27 · CVE-2020-8243

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 9.1R8.2

Description The issue is related to the Pulse Connect Secure admin web interface, where an authenticated attacker could potentially upload a custom template to execute arbitrary code. This is due to incorrect code generation management in the web interface. An attacker, acting remotely, could exploit this to execute arbitrary code.

Recommendations For versions prior to 9.1R8.2, update to version 9.1R8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin web interface to minimize the risk of exploitation. Avoid using the template upload feature in the affected admin web interface until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2021-05085

CVE-2020-8243

Affected Products

Pulse Connect Secure

References · 8

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8243 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8243 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05085 · Security Note
• https://t.me/true_secator/1675 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8243 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/true_secator/1642 · Telegram Post