CVE-2021-22899highunder attackCWE-77

CVE-2021-22899: high-severity vulnerability in Pulse Connect Secure

Published · Updated

Follow this CVE+ Monitor Connect Secure+ Monitor Pulse Connect Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 23%
from disclosure to weapon
Published on NVDMay 27
CISA KEV+160d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Pulse Connect Secure has a flaw in its Windows Resource Profiles feature that lets authenticated users run arbitrary commands on the server. This is dangerous because someone with login credentials can take over the system.

Technical detail

CWE-77 command injection vulnerability in the Windows Resource Profiles feature of Pulse Connect Secure versions prior to 9.1R11.4 allows an authenticated attacker to execute arbitrary system commands with the privileges of the application, leading to complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Pulse Connect Secure