CVE-2019-11508

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.

References

http://www.securityfocus.com/bid/108073

https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/

https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf

https://kb.pulsesecure.net/?atype=sa

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010

https://www.kb.cert.org/vuls/id/927237

Details

Source: MITRE

Published: 2019-05-08

Updated: 2019-08-09

Type: CWE-22

Risk Information

CVSS v2

Base Score: 6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8

Severity: MEDIUM

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.2

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r10.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r11.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r12.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r13.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r14.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r15.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r16.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r17.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r18.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r19.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r19.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r2.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r21.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.4:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r3.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r4.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r4.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r5.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r6.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r7.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r8.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r9.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r1.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r10.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r11.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r11.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r12.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.4:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.5:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.6:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r2.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r3.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r4.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r5.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r6.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r7.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r8.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:*:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r1.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r1.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r10.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r11.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r11.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r12.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r12.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r13.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r14.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r2.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r2.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r3.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r3.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r4.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r4.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r5.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r6.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r7.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r8.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r10.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r11.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r12.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r2.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r6.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r9.0:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r4:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r7:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:*

cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:*

Tenable Plugins

View all (1 total)

IDNameProductFamilySeverity
124766Pulse Connect Secure Multiple Vulnerabilities (SA44101)NessusMisc.
critical