PT-2021-4945 · Ivanti · Ivanti Pulse Connect Secure

Published 2021-05-03 · Updated 2024-02-27 · CVE-2021-22900

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Pulse Connect Secure versions prior to 9.1R11.4

Description The issue is related to an unrestricted file upload in the administrator web interface of Pulse Connect Secure. This could allow an authenticated administrator to perform a file write via a maliciously crafted archive upload. The vulnerability may enable a remote attacker to elevate their privileges.

Recommendations For versions prior to 9.1R11.4, update to version 9.1R11.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator web interface to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

CWE-669

Related Identifiers

BDU:2021-05699

CVE-2021-22900

Affected Products

Ivanti Pulse Connect Secure

References · 5

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22900 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05699 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22900 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22900 · Note