CVE-2019-11510
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 2 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Pulse Connect Secure allows attackers to read any file on the server without logging in by sending a specially crafted web request. This exposes sensitive data like passwords and configuration files.
An unauthenticated remote attacker can exploit path traversal (CWE-22) via malicious URI requests to Pulse Connect Secure to read arbitrary files from the affected server. The vulnerability requires no authentication or user interaction and can result in unauthorized disclosure of sensitive information.
The full analysis of this CVE is available in Portuguese →