Lucene search

[email protected]CVE-2021-31922

HistoryMay 14, 2021 - 1:15 a.m.

CVE-2021-31922

2021-05-1401:15:06

CWE-444

[email protected]

web.nvd.nist.gov

cve-2021-31922

pulse secure

virtual traffic manager

http request smuggling

vulnerability

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.6%

JSON

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.

Affected configurations

NVD

Node

pulsesecurevirtual_traffic_managerRange≤18.1

pulsesecurevirtual_traffic_managerRange18.3–19.1

pulsesecurevirtual_traffic_managerMatch18.2-

pulsesecurevirtual_traffic_managerMatch18.2r1

pulsesecurevirtual_traffic_managerMatch19.2-

pulsesecurevirtual_traffic_managerMatch19.2r1

pulsesecurevirtual_traffic_managerMatch19.2r2

pulsesecurevirtual_traffic_managerMatch19.3

pulsesecurevirtual_traffic_managerMatch20.1-

pulsesecurevirtual_traffic_managerMatch20.2-

pulsesecurevirtual_traffic_managerMatch20.3-

CPENameOperatorVersion
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managerle18.1
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managerle19.1
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq18.2
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq19.2
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq19.3
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq20.1
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq20.2
pulsesecure:virtual_traffic_managerpulsesecure virtual traffic managereq20.3

CPE	Name	Operator	Version
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	le	18.1
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	le	19.1
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	18.2
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	19.2
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	19.3
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	20.1
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	20.2
pulsesecure:virtual_traffic_manager	pulsesecure virtual traffic manager	eq	20.3

References

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.6%

JSON

Related for CVE-2021-31922

nvd1 cvelist1 prion1