Lucene search

[email protected]CVE-2018-6320

HistorySep 06, 2018 - 11:29 p.m.

CVE-2018-6320

2018-09-0623:29:00

CWE-20

[email protected]

web.nvd.nist.gov

cve

2018

6320

pulse secure

pulse connect secure

pcs

pulse policy secure

pps

vulnerability

http

https

host header

browser

validation

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

60.4%

JSON

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation.

CPENameOperatorVersion
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r7.0
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq8.1r1.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r2.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r7.1
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r4.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r3.2
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r1.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r5.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r6.0
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.2r8.0

CPE	Name	Operator	Version
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r7.0
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	8.1r1.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r2.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r7.1
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r4.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r3.2
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r1.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r5.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r6.0
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.2r8.0

Rows per page:

1-10 of 181

References

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

60.4%

JSON

Related for CVE-2018-6320

cvelist1 prion1