BDU:2023-00990

Опубликовано: 25 апр. 2019

Источник: fstec

CVSS3: 8

CVSS2: 9

EPSS Критический

Описание

Уязвимость веб-интерфейса администрирования VPN-шлюза корпоративных сетей Pulse Connect Secure связана с недостаточной очисткой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код путем отправки специально созданного запроса

Вендор

Pulsesecure

Наименование ПО

Pulse Connect Secure

Pulse Policy Secure

Версия ПО

8.1 R1.0 (Pulse Connect Secure)

8.1 (Pulse Connect Secure)

8.2 R7.0 (Pulse Connect Secure)

8.2 R4.0 (Pulse Connect Secure)

8.2 R2.0 (Pulse Connect Secure)

8.2 R1.0 (Pulse Connect Secure)

8.2 R7.1 (Pulse Connect Secure)

8.2 R4.1 (Pulse Connect Secure)

8.2 R3.0 (Pulse Connect Secure)

8.2 R5.0 (Pulse Connect Secure)

8.2 R3.1 (Pulse Connect Secure)

8.2 R5.1 (Pulse Connect Secure)

8.2 R6.0 (Pulse Connect Secure)

9.0 R3.1 (Pulse Connect Secure)

9.0 R3.2 (Pulse Connect Secure)

9.0 R1 (Pulse Connect Secure)

9.0 R2 (Pulse Connect Secure)

9.0 R2.1 (Pulse Connect Secure)

9.0 R3 (Pulse Connect Secure)

8.2r1.1 (Pulse Connect Secure)

8.2 (Pulse Connect Secure)

8.2RX (Pulse Connect Secure)

8.3 (Pulse Connect Secure)

8.3RX (Pulse Connect Secure)

9.0RX (Pulse Connect Secure)

5.1R1.0 (Pulse Policy Secure)

5.1R1.1 (Pulse Policy Secure)

5.1R2.0 (Pulse Policy Secure)

5.1R2.1 (Pulse Policy Secure)

5.1R3.0 (Pulse Policy Secure)

5.1R3.2 (Pulse Policy Secure)

5.1R4.0 (Pulse Policy Secure)

5.1R5.0 (Pulse Policy Secure)

5.1R6.0 (Pulse Policy Secure)

5.1R7.0 (Pulse Policy Secure)

5.1R8.0 (Pulse Policy Secure)

5.1R9.0 (Pulse Policy Secure)

5.1R9.1 (Pulse Policy Secure)

5.1R10.0 (Pulse Policy Secure)

5.1R11.0 (Pulse Policy Secure)

5.1R11.1 (Pulse Policy Secure)

5.1R12.0 (Pulse Policy Secure)

5.1R12.1 (Pulse Policy Secure)

5.1R13.0 (Pulse Policy Secure)

5.1R14.0 (Pulse Policy Secure)

5.2R1.0 (Pulse Policy Secure)

5.2R2.0 (Pulse Policy Secure)

5.2R3.0 (Pulse Policy Secure)

5.2R3.2 (Pulse Policy Secure)

5.2R4.0 (Pulse Policy Secure)

5.2R5.0 (Pulse Policy Secure)

5.2R6.0 (Pulse Policy Secure)

5.2R7.0 (Pulse Policy Secure)

Тип ПО

ПО программно-аппаратного средства

Сетевое средство

Операционные системы и аппаратные платформы

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 9)

Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11539
CVE

EPSS

Процентиль: 100%

0.93911

Критический

8 High

CVSS3

9 Critical

CVSS2

Связанные уязвимости

CVE-2019-11539

CVSS3: 7.2

nvd

почти 7 лет назад

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

GHSA-mchx-p635-vpq8