#VU40261 Input validation error in Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2016-4788

Vulnerability identifier: #VU40261

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-4788

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Server applications / Remote access servers, VPN

Vendor: Ivanti

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Ivanti Connect Secure (formerly Pulse Connect Secure): 7.4 - 8.2

---

External links
https://www.securitytracker.com/id/1035932
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40208

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.