Main Vulnerability Database Vulnerabilities #VU31943

Command Injection in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2020-8220

Published: July 27, 2020

Vulnerability identifier: #VU31943

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8220

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing user-supplied input within the administrator web interface. A remote authenticated user can perform command injection that causes denial of service.

Affected software

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

How to mitigate CVE-2020-8220

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 9.1R8
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 9.1R8

External References

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516/p?pubstatus=o

Related Security Bulletins