Lucene search

[email protected]CVE-2019-11540

HistoryApr 26, 2019 - 2:29 a.m.

CVE-2019-11540

2019-04-2602:29:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2019-11540

pulse secure

pulse connect secure

pulse policy secure

session hijacking

remote attack

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.035 Low

EPSS

Percentile

91.5%

JSON

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.

CPENameOperatorVersion
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r1
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r2
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r2.1
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r3
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4rx
pulsesecure:pulse_connect_securepulsesecure pulse connect secureeq8.3rx
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r4
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r5
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r5.2
pulsesecure:pulse_policy_securepulsesecure pulse policy secureeq5.4r6

CPE	Name	Operator	Version
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r1
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r2
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r2.1
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r3
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4rx
pulsesecure:pulse_connect_secure	pulsesecure pulse connect secure	eq	8.3rx
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r4
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r5
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r5.2
pulsesecure:pulse_policy_secure	pulsesecure pulse policy secure	eq	5.4r6

Rows per page:

1-10 of 261

References

www.securityfocus.com/bid/108073

devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/

i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010

www.kb.cert.org/vuls/id/927237

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.035 Low

EPSS

Percentile

91.5%

JSON

Related for CVE-2019-11540

prion1 nessus2 hackerone4 myhack581 cert1