CVE-2020-8260

Warnung

Exploit

EPSS 96.48%
Veröffentlicht 28.10.2020 13:15:13
Zuletzt bearbeitet 30.10.2025 20:40:55
Erkennungen
Login

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 6

NVD 16 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ivanti ≫ Connect Secure Version <= 9.0

Ivanti ≫ Connect Secure Version 9.1 Update -

Ivanti ≫ Connect Secure Version 9.1 Update r1.0

Ivanti ≫ Connect Secure Version 9.1 Update r2.0

Ivanti ≫ Connect Secure Version 9.1 Update r3.0

Ivanti ≫ Connect Secure Version 9.1 Update r4.0

Ivanti ≫ Connect Secure Version 9.1 Update r4.1

Ivanti ≫ Connect Secure Version 9.1 Update r4.2

Ivanti ≫ Connect Secure Version 9.1 Update r4.3

Ivanti ≫ Connect Secure Version 9.1 Update r5.0

Ivanti ≫ Connect Secure Version 9.1 Update r6.0

Ivanti ≫ Connect Secure Version 9.1 Update r7.0

Ivanti ≫ Connect Secure Version 9.1 Update r8.0

Ivanti ≫ Connect Secure Version 9.1 Update r8.1

Ivanti ≫ Connect Secure Version 9.1 Update r8.2

Ivanti ≫ Connect Secure Version 9.1 Update r8.4

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Ivanti Pulse Connect Secure Code Execution Vulnerability

Schwachstelle

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	96.48%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P
CISA-ADP	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H