Vulnerability identifier: #VU55617
Vulnerability risk: Low
CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-434
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Pulse Connect Secure
Server applications /
Remote access servers, VPN
Vendor: Pulse Secure
Description
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload within the administrative interface. A remote privileged user can upload a malicious archive and execute it on the server.
Note, the vulnerability is being actively exploited in the wild as of August 2021.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Pulse Connect Secure: 9.1R1 - 9.1R11.5
External links
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/p?pubstatus=o
http://us-cert.cisa.gov/ncas/current-activity/2021/08/24/cisa-releases-five-pulse-secure-related-mars
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.