Main Vulnerability Database Vulnerabilities #VU31941

Path traversal in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2020-8222

Published: July 27, 2020

Vulnerability identifier: #VU31941

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8222

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the admin interface. A remote user can send a specially crafted HTTP request and read arbitrary files on the system through Meeting.

Affected software

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

How to mitigate CVE-2020-8222

Install update from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 9.1R8
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 9.1R8

External References

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516/p?pubstatus=o

Related Security Bulletins