CVE-2020-8243: high-severity vulnerability in Pulse Connect Secre
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
73Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA.
ssvc Actcvss 7.2epss 91%
from disclosure to weapon
Published on NVDSep 29
CISA KEV+400d
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
An authenticated attacker can upload a custom template to Pulse Connect Secure's admin interface (versions before 9.1R8.2) to execute arbitrary code on the server.
Technical detail
The vulnerability exists in the admin web interface's template upload functionality, allowing authenticated users to upload malicious templates that bypass validation and execute arbitrary code. CWE-94 (Code Injection) permits template injection leading to remote code execution with authenticated access as a prerequisite.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Pulse Connect Secre