CVE-2020-8218highunder attackCWE-94

CVE-2020-8218: high-severity vulnerability in Pulse Connect Secure

Published · Updated

Follow this CVE+ Monitor Connect Secure+ Monitor Pulse Connect Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.2epss 32%
from disclosure to weapon30 days
Published on NVDJul 30
1st PoC+30d
CISA KEV+585d
Action required by CISAfederal deadline: 2022-09-07

Apply updates per vendor instructions.

In short

Pulse Connect Secure versions before 9.1R8 contain a code injection flaw in the admin interface that lets attackers execute arbitrary code by crafting a malicious URL.

Technical detail

A code injection vulnerability (CWE-94) in the admin web interface of Pulse Connect Secure <9.1R8 allows unauthenticated or low-privileged attackers to execute arbitrary code by sending a crafted URI. The vulnerability requires network access to the admin interface and results in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Pulse Connect Secure
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.