PT-2021-3892 · Pulse · Pulse Connect Secure

Published 2021-08-11 · Updated 2024-02-27 · CVE-2021-22937

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 9.1R12

Description The issue allows an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. This could potentially enable a remote attacker to execute arbitrary code by uploading a specially crafted archive through the administrator web interface.

Recommendations For Pulse Connect Secure versions prior to 9.1R12, update to version 9.1R12 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator web interface to minimize the risk of exploitation. Avoid using the feature that allows uploading archives until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-04277

CVE-2021-22937

Affected Products

Pulse Connect Secure

References · 7

• https://osv.dev/vulnerability/CVE-2021-22937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22937 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04277 · Security Note
• https://t.me/cybersecuritytechnologies/4203 · Telegram Post
• https://t.me/cybersecuritytechnologies/4044 · Telegram Post
• https://t.me/cibsecurity/27395 · Telegram Post