In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:21
Type | Values Removed | Values Added |
---|---|---|
References | () http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html - Third Party Advisory, VDB Entry | |
References | () http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html - Third Party Advisory, VDB Entry | |
References | () http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html - Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/108073 - Third Party Advisory, VDB Entry | |
References | () https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - Exploit, Third Party Advisory | |
References | () https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - Exploit, Third Party Advisory | |
References | () https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 - Third Party Advisory, Vendor Advisory | |
References | () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 - Third Party Advisory | |
References | () https://www.kb.cert.org/vuls/id/927237 - Third Party Advisory, US Government Resource |
27 Feb 2024, 21:04
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:*:*:*:*:*:*:* |
cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:*:*:*:*:*:*:* |
First Time |
Ivanti connect Secure
Ivanti |
Information
Published : 2019-04-26 02:29
Updated : 2024-11-21 04:21
NVD link : CVE-2019-11539
Mitre link : CVE-2019-11539
CVE.ORG link : CVE-2019-11539
JSON object : View
Products Affected
pulsesecure
- pulse_connect_secure
- pulse_policy_secure
ivanti
- connect_secure
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')