← Back to CVEs

CVE-2019-11539

HIGHCISA KEV

7.2

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published4/26/2019

Last Modified11/6/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorIvanti

ProductPulse Connect Secure and Pulse Policy Secure

Vulnerability NameIvanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

KEV Date Added2021-11-03

Remediation Due Date2022-05-03

Ransomware UseKnown

Affected Products

ivanti:connect_secureivanti:policy_securepulsesecure:pulse_policy_secure

Weaknesses (CWE)

CWE-78CWE-78

References

http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html(cve@mitre.org)

http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(cve@mitre.org)

http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(cve@mitre.org)

http://www.securityfocus.com/bid/108073(cve@mitre.org)

https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(cve@mitre.org)

https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(cve@mitre.org)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101(cve@mitre.org)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(cve@mitre.org)

https://www.kb.cert.org/vuls/id/927237(cve@mitre.org)

http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/108073(af854a3a-2127-422b-91ae-364da2661108)

https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(af854a3a-2127-422b-91ae-364da2661108)

https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101(af854a3a-2127-422b-91ae-364da2661108)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(af854a3a-2127-422b-91ae-364da2661108)

https://www.kb.cert.org/vuls/id/927237(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.