CVE-2020-8240

2020-10-2812:41:44

hackerone

www.cve.org

pulse secure

vulnerability

system-level privilege escalation

windows pdc

embedded browser

credential provider

AI Score

7.5

Confidence

High

EPSS

Percentile

12.6%

JSON

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the Credential Provider.

CNA Affected

[
  {
    "product": "Pulse Secure Desktop Client",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "9.1R9"
      }
    ]
  }
]

References

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601