CVE-2019-11510
Detail
Modified
This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Description
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
Severity
CVSS
Version 3.x
CVSS
Version 2.0
CVSS 3.x Severity and Metrics:
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 Severity and Metrics:
Vector:
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to nvd@nist.gov .
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference
CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
Vulnerability Name
Date Added
Due Date
Required Action
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
11/03/2021
04/23/2021
Apply updates per vendor instructions.
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
NIST
Change History
53 change records found show changes
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r7:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r6:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.2:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r5:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r4:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r3:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r2:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.3:r1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r12.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r11.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r10.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r9.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.2:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r8.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r7.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r6.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r5.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r4.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r2.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 2/27/2024 4:04:17 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.0:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.3:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*
CPE Deprecation Remap by NIST 1/13/2024 1:36:49 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:*
OR
*cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
CVE Modified by MITRE 11/06/2023 10:03:02 PM
Action
Type
Old Value
New Value
Added
Reference
MITRE https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacamole.apache.org%3E [No types assigned]
Removed
Reference
MITRE https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E
Modified Analysis by NIST 3/24/2023 1:36:07 PM
Action
Type
Old Value
New Value
Changed
Reference Type
http://www.securityfocus.com/bid/108073 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/108073 Broken Link, Third Party Advisory, VDB Entry
Changed
Reference Type
https://www.kb.cert.org/vuls/id/927237 No Types Assigned
https://www.kb.cert.org/vuls/id/927237 Third Party Advisory, US Government Resource
CWE Remap by NIST 8/24/2020 1:37:01 PM
Action
Type
Old Value
New Value
Changed
CWE
CWE-275
CWE-22
CVE Modified by MITRE 10/16/2019 2:15:23 PM
Action
Type
Old Value
New Value
Added
Reference
https://www.kb.cert.org/vuls/id/927237 [No Types Assigned]
CVE Modified by MITRE 10/09/2019 7:45:26 PM
Action
Type
Old Value
New Value
Added
CVSS V3
MITRE AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Reanalysis by NIST 9/24/2019 3:34:25 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
Record truncated, showing 500 of 8064 characters.
View Entire Change Record
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:*:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.1:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r10.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r11.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r12.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r13.0:*:*:*:*:*:*
*
Record truncated, showing 500 of 2575 characters.
View Entire Change Record
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r1.1:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r10.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r11.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r12.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r2.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:r3.0:*:*:*:*:*:*
Modified Analysis by NIST 9/20/2019 8:22:05 AM
Action
Type
Old Value
New Value
Added
CVSS V2
NIST (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Removed
CVSS V2
NIST (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Removed
CVSS V3
NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CVSS V3.1
NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Changed
Reference Type
http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html No Types Assigned
http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html Third Party Advisory, VDB Entry
Changed
Reference Type
http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html No Types Assigned
http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html Third Party Advisory, VDB Entry
Changed
Reference Type
http://www.securityfocus.com/bid/108073 No Types Assigned
http://www.securityfocus.com/bid/108073 Third Party Advisory, VDB Entry
Changed
Reference Type
https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ No Types Assigned
https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ Third Party Advisory
Changed
Reference Type
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ No Types Assigned
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ Third Party Advisory
Changed
Reference Type
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf No Types Assigned
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf Third Party Advisory
Changed
Reference Type
https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E Third Party Advisory
Changed
Reference Type
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 No Types Assigned
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 Third Party Advisory
CVE Modified by MITRE 9/12/2019 2:15:11 PM
Action
Type
Old Value
New Value
Added
Reference
https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E [No Types Assigned]
CVE Modified by MITRE 9/06/2019 6:15:11 PM
Action
Type
Old Value
New Value
Added
Reference
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ [No Types Assigned]
CVE Modified by MITRE 9/06/2019 5:15:11 PM
Action
Type
Old Value
New Value
Added
Reference
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf [No Types Assigned]
CVE Modified by MITRE 8/27/2019 11:15:11 AM
Action
Type
Old Value
New Value
Added
Reference
http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html [No Types Assigned]
CVE Modified by MITRE 8/26/2019 10:15:10 AM
Action
Type
Old Value
New Value
Added
Reference
https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ [No Types Assigned]
CVE Modified by MITRE 8/21/2019 7:15:11 PM
Action
Type
Old Value
New Value
Added
Reference
http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html [No Types Assigned]
CVE Modified by MITRE 8/09/2019 7:15:17 PM
Action
Type
Old Value
New Value
Added
Reference
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 [No Types Assigned]
CVE Modified by MITRE 5/10/2019 3:29:06 PM
Action
Type
Old Value
New Value
Changed
Description
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker can upload a malicious file to write to arbitrary files, because of Insecure Permissions.
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
Added
Reference
http://www.securityfocus.com/bid/108073 [No Types Assigned]
Initial Analysis by NIST 5/09/2019 1:24:34 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
Record truncated, showing 500 of 8064 characters.
View Entire Change Record
OR
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:*:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r1.1:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r10.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r11.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r12.0:*:*:*:*:*:*
*cpe:2.3:a:pulsesecure:pulse_connect_secure:7.1:r13.0:*:*:*:*:*:*
*
Added
CVSS V2
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Added
CVSS V3
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CWE
CWE-275
Changed
Reference Type
https://kb.pulsesecure.net/?atype=sa No Types Assigned
https://kb.pulsesecure.net/?atype=sa Vendor Advisory
Changed
Reference Type
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ No Types Assigned
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Patch, Vendor Advisory
Quick Info
CVE Dictionary Entry: CVE-2019-11510 NVD
Published Date: 05/08/2019 NVD
Last Modified: 02/27/2024
Source: MITRE