Main Vulnerability Database Vulnerabilities #VU27041

Improper access control in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2019-11509

Published: April 20, 2020

Vulnerability identifier: #VU27041

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11509

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the admin web interface in Pulse Connect Secure and Pulse Policy Secure. A remote authenticated user can bypass implemented security restrictions and execute arbitrary system commands on the appliance.

Affected software

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

How to mitigate CVE-2019-11509

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - addressed in versions 5.1R15.1, 5.2R12.1, 5.3R12.1, 5.4R7.1, 9.0R3.2
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 8.1R15.1, 8.2R12.1, 8.3R7.1, 9.0R3.4

External References

Related Security Bulletins