CVE-2021-22900
CVE-2021-22900
In short
An authenticated administrator could upload a malicious archive file through the Pulse Connect Secure web interface, allowing them to write arbitrary files to the system. This vulnerability affects versions before 9.1R11.4.
Technical detail
CWE-94 (Improper Control of Generation of Code) manifests via unrestricted archive uploads in the admin interface. An authenticated administrator can craft a malicious archive to write files to the system due to insufficient validation of archive contents. Exploitation requires admin privileges and affects Pulse Connect Secure versions prior to 9.1R11.4.
Summary generated and translated by AI from the official description.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Pulse Secure SecureWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →