SB2019062819 - Multiple vulnerabilities in Pulse Connect Secure 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019062819

SB2019062819 - Multiple vulnerabilities in Pulse Connect Secure

Published: June 28, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019062819
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2018-20809)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX.


2) Inadequate Encryption Strength (CVE-ID: CVE-2018-20810)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices.


3) Cross-site scripting (CVE-ID: CVE-2018-20814)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX.


Remediation

Install update from vendor's website.

References