CVE-2019-11508high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.
References
http://www.securityfocus.com/bid/108073
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
https://kb.pulsesecure.net/?atype=sa
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
Details
Source: MITRE
Published: 2019-05-08
Updated: 2019-08-09
Type: CWE-22
Risk Information
CVSS v2
Base Score: 6.5
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 8
Severity: MEDIUM
CVSS v3
Base Score: 7.2
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1.2
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r12.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r13.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r14.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r15.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r16.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r17.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r18.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r19.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r19.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r2.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r20.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r21.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r22.4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r3.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r4.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r5.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r6.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r7.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r8.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r9.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r1.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r10.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r11.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r11.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r12.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.5:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r13.6:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r2.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r3.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r4.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r5.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r6.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r7.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r8.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:r9.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r1.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r1.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r11.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r12.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r12.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r13.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r14.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r2.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r2.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r3.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r3.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r4.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r5.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r6.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r7.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r8.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:r9.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r10.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r11.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r12.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r2.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r6.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r9.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r7:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:*