New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 10
Synopsis
The remote host is affected by multiple vulnerabilities.
Description
According to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities.
- An arbitrary file read vulnerability exists in PCS. An unauthenticated, remote attacker can exploit this, via specially crafted URI, to read arbitrary files and disclose sensitive information. (CVE-2019-11510)
- Multiple vulnerabilities are found in Ghostscript.(CVE-2018-16513 , CVE-2018-18284, CVE-2018-15911, CVE-2018-15910, CVE-2018-15909)
- A session hijacking vulnerability exists in PCS. An unauthenticated, remote attacker can exploit this, to perform actions in the user or administrator interface with the privileges of another user. (CVE-2019-11540)
- An authentication leaks seen in users using SAML authentication with the reuse existing NC (Pulse) session option.
(CVE-2019-11541)
- Multiple vulnerabilities found in the admin web interface of PCS.
(CVE-2019-11543, CVE-2019-11542, CVE-2019-11509, CVE-2019-11539)
- Multiple vulnerabilities found in Network File Share (NFS) of PCS , allows the attacker to read/write arbitrary files on the affected device. (CVE-2019-11538, CVE-2019-11508)
- A cross-site scripting (XSS) vulnerability exists in application launcher page due to improper validation of user-supplied input before returning it to users. An attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.
(CVE-2019-11507)
Refer to the vendor advisory for additional information.
Solution
Upgrade to the appropriate version referenced in the advisory.