CVE-2021-22900highunder attackCWE-94

CVE-2021-22900: high-severity vulnerability in Pulse Secure Secure

Published · Updated

Follow this CVE+ Monitor Connect Secure+ Monitor Pulse Secure Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.2epss 14%
from disclosure to weapon
Published on NVDMay 27
CISA KEV+160d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

An authenticated administrator could upload a malicious archive file through the Pulse Connect Secure web interface, allowing them to write arbitrary files to the system. This vulnerability affects versions before 9.1R11.4.

Technical detail

CWE-94 (Improper Control of Generation of Code) manifests via unrestricted archive uploads in the admin interface. An authenticated administrator can craft a malicious archive to write files to the system due to insufficient validation of archive contents. Exploitation requires admin privileges and affects Pulse Connect Secure versions prior to 9.1R11.4.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Pulse Secure Secure