CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
44.3%
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Vendor | Product | Version | CPE |
---|---|---|---|
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.0:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.1:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r2.0:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r3.0:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.1:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.2:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.0:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.2:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r6.0:*:*:*:windows:*:* |
pulsesecure | pulse_secure_desktop_client | 5.3 | cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r7.0:*:*:*:windows:*:* |
packetstormsecurity.com/files/158117/Pulse-Secure-Client-For-Windows-Local-Privilege-Escalation.html
packetstormsecurity.com/files/159065/Pulse-Secure-Windows-Client-Privilege-Escalation.html
seclists.org/fulldisclosure/2020/Jun/25
seclists.org/fulldisclosure/2020/Sep/15
kb.pulsesecure.net/?atype=sa
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44503
twitter.com/gsepcali/status/1262551597990711296
twitter.com/gsepcali/status/1272927080909623297
twitter.com/sepcali/status/1262551597990711296
www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
44.3%