PT-2021-5279 · Pulse · Pulse Connect Secure

Published 2021-11-19 · Updated 2024-02-27 · CVE-2021-22965

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 9.1R12.1

Description A vulnerability in Pulse Connect Secure could allow an unauthenticated administrator to cause a denial of service when a malformed request is sent to the device. This issue is related to an uncontrolled resource consumption. An attacker, acting remotely, can exploit this vulnerability by sending an incorrect request to the device, resulting in a denial of service.

Recommendations For versions prior to 9.1R12.1, update to version 9.1R12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Avoid sending malformed requests to the device until the issue is resolved.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-06105

CVE-2021-22965

Affected Products

Pulse Connect Secure

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-22965 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44879/?kA13Z000000L3ZF · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06105 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22965 · Vendor Advisory
• https://t.me/cibsecurity/32738 · Telegram Post
• http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44899/p?pubstatus=o · Note
• https://t.me/cvenotify/23661 · Telegram Post