CVE-2019-11509

Опубликовано: 03 июн. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.

Ссылки

https://kb.pulsesecure.net/?atype=sa
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
Vendor Advisory
https://www.kb.cert.org/vuls/id/927237
Third Party Advisory
US Government Resource
https://kb.pulsesecure.net/?atype=sa
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
Vendor Advisory
https://www.kb.cert.org/vuls/id/927237
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r1.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r10.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r11.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r2.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r3.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r3.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r4.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r5.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r6.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r7.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r7.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r8.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r9.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r9.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r2.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r4:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r5:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r5.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r6:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r6.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r7:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06923

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-f2cx-w4q6-4qq4