Описание
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.1:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r2.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r3.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.1:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.2:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.2:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r6.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r7.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r1.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2.1:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3.2:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r5.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r6.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r1.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r2.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.1:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.1:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.2:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r5.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r6.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7.0:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_installer_service:8.3:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_installer_service:9.1:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_installer_service:9.1:r5.0:*:*:*:windows:*:*
EPSS
Процентиль: 57%
0.00347
Низкий
7 High
CVSS3
6.9 Medium
CVSS2
Дефекты
CWE-367
CWE-367
Связанные уязвимости
CVSS3: 7
github
больше 3 лет назад
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
CVSS3: 7
fstec
больше 5 лет назад
Уязвимость исполняемого файла PulseSecureService.exe корпоративного SSL на основе VPN Pulse Secure Desktop Client, позволяющая нарушителю повысить свои привилегии
EPSS
Процентиль: 57%
0.00347
Низкий
7 High
CVSS3
6.9 Medium
CVSS2
Дефекты
CWE-367
CWE-367