#VU31944 Permissions, Privileges, and Access Controls in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2020-12880

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31944

#VU31944 Permissions, Privileges, and Access Controls in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2020-12880

Published: July 27, 2020


Vulnerability identifier: #VU31944
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-12880
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Software vendor:
Ivanti

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper security restrictions. An attacker with physical access to the device can manipulate kernel boot parameter to gain the root access of VA Appliances.


Remediation

Install updates from vendor's website.

External links