Main
Vulnerability Database
Exploits
ID:5996 - Exploit for OS Command Injection in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2019-11539
ID:5996 - Exploit for OS Command Injection in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2019-11539
Published: June 17, 2021
Vulnerability identifier: #VU27039
Vulnerability risk: Medium
CVE-ID: CVE-2019-11539
CWE-ID: CWE-78
Exploitation vector: Remote access
Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in admin web interface of Pulse Connect Secure and Pulse Policy Secure. A remote authenticated user can execute arbitrary OS commands.
Remediation
Install updates from vendor's website.