CVE-2021-31922

Опубликовано: 14 мая 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.

Ссылки

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790
Exploit
Patch
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790
Exploit
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pulsesecure:virtual_traffic_manager:*:*:*:*:*:*:*:*

Версия до 18.1 (включая)

cpe:2.3:a:pulsesecure:virtual_traffic_manager:*:*:*:*:*:*:*:*

Версия от 18.3 (включая) до 19.1 (включая)

cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:-:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:r1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:-:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.3:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.1:-:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.2:-:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.3:-:*:*:*:*:*:*

EPSS

Процентиль: 41%

0.00189

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-444

Связанные уязвимости

GHSA-85qj-2cfq-3wp8