CVE-2020-15408: An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8

Medium severity · published Jul 28, 2020

CVE-2020-15408

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8

4.6

CVSS

0.8%

EPSS

On KEV

Description

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 55% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Pulse Connect Secure · Pulsesecure

through 9.1 · source: NVD

Pulse Secure Desktop Client · Pulsesecure

9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +4 more · source: NVD

Affected product

Pulse Connect Secure

Pulsesecure

All Pulse Connect Secure CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-15408

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-15408

Vendor Advisory

https://kb.pulsesecure.net/?atype=sa

Vendor Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516