CVE-2021-22893

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-22893
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://blog.pulsesecure.net/pulse-connect-secure-security-update/ Vendor Advisory
https://kb.cert.org/vuls/id/213092 Third Party Advisory US Government Resource
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ Vendor Advisory
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html Third Party Advisory
https://blog.pulsesecure.net/pulse-connect-secure-security-update/ Vendor Advisory
https://kb.cert.org/vuls/id/213092 Third Party Advisory US Government Resource
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ Vendor Advisory
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html Third Party Advisory
https://www.kb.cert.org/vuls/id/213092
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*
History

21 Nov 2024, 05:50

Type Values Removed Values Added
References
  • () https://www.kb.cert.org/vuls/id/213092 -
References () https://blog.pulsesecure.net/pulse-connect-secure-security-update/ - Vendor Advisory () https://blog.pulsesecure.net/pulse-connect-secure-security-update/ - Vendor Advisory
References () https://kb.cert.org/vuls/id/213092 - Third Party Advisory, US Government Resource () https://kb.cert.org/vuls/id/213092 - Third Party Advisory, US Government Resource
References () https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ - Vendor Advisory () https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ - Vendor Advisory
References () https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html - Third Party Advisory () https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html - Third Party Advisory

27 Feb 2024, 21:04

Type Values Removed Values Added
CPE cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:-:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8.4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r9.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r9.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r3:*:*:*:*:*:*		 cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*

13 Jan 2024, 18:36

Type Values Removed Values Added
First Time Ivanti connect Secure
Ivanti
CPE cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r5.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r6.0:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.5:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:-:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:*		 cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*
Information

Published : 2021-04-23 17:15

Updated : 2024-11-21 05:50

NVD link : CVE-2021-22893

Mitre link : CVE-2021-22893

CVE.ORG link : CVE-2021-22893

JSON object : View

Products Affected

ivanti

  • connect_secure
CWE
CWE-287

Improper Authentication

CWE-416

Use After Free


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024