PT-2021-19597 · Pulse Secure · Pulse Secure Virtual Traffic Manager

Published 2021-05-14 · Updated 2022-07-12 · CVE-2021-31922

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Pulse Secure Virtual Traffic Manager versions prior to 21.1 Pulse Secure Virtual Traffic Manager versions 20.3 through 20.3R1 Pulse Secure Virtual Traffic Manager versions 20.2 through 20.2R1 Pulse Secure Virtual Traffic Manager versions 20.1 through 20.1R2 Pulse Secure Virtual Traffic Manager versions 19.2 through 19.2R4 Pulse Secure Virtual Traffic Manager versions 18.2 through 18.2R3

Description: An HTTP Request Smuggling issue could allow an attacker to smuggle an HTTP request through an HTTP/2 Header.

Recommendations: For versions prior to 21.1, update to version 21.1 or later. For versions 20.3, update to 20.3R1 or later. For versions 20.2, update to 20.2R1 or later. For versions 20.1, update to 20.1R2 or later. For versions 19.2, update to 19.2R4 or later. For versions 18.2, update to 18.2R3 or later.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-31922

Affected Products

Pulse Secure Virtual Traffic Manager

References · 4

• 🔥 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31922 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31922 · Vendor Advisory
• https://t.me/cvenotify/14420 · Telegram Post