7.2

CVE-2021-22938

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Connect Secure Version 9.1 Update -
Ivanti ≫ Connect Secure Version 9.1 Update r1.0
Ivanti ≫ Connect Secure Version 9.1 Update r10.0
Ivanti ≫ Connect Secure Version 9.1 Update r11.0
Ivanti ≫ Connect Secure Version 9.1 Update r2.0
Ivanti ≫ Connect Secure Version 9.1 Update r3.0
Ivanti ≫ Connect Secure Version 9.1 Update r4.0
Ivanti ≫ Connect Secure Version 9.1 Update r5.0
Ivanti ≫ Connect Secure Version 9.1 Update r6.0
Ivanti ≫ Connect Secure Version 9.1 Update r7.0
Ivanti ≫ Connect Secure Version 9.1 Update r8.0
Ivanti ≫ Connect Secure Version 9.1 Update r9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.1% 0.793
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC
Vendor Advisory