← Voltar para CVEs

CVE-2019-11539

HIGHCISA KEV

7.2

Descricao

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

Detalhes CVE

Pontuacao CVSS v3.17.2

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado4/26/2019

Ultima modificacao11/6/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorIvanti

ProdutoPulse Connect Secure and Pulse Policy Secure

Nome da vulnerabilidadeIvanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

Data inclusao KEV2021-11-03

Prazo de remediacao2022-05-03

Uso em ransomwareKnown

Produtos afetados

ivanti:connect_secureivanti:policy_securepulsesecure:pulse_policy_secure

Fraquezas (CWE)

CWE-78CWE-78

Referencias

http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html(cve@mitre.org)

http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(cve@mitre.org)

http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(cve@mitre.org)

http://www.securityfocus.com/bid/108073(cve@mitre.org)

https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(cve@mitre.org)

https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(cve@mitre.org)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101(cve@mitre.org)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(cve@mitre.org)

https://www.kb.cert.org/vuls/id/927237(cve@mitre.org)

http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/108073(af854a3a-2127-422b-91ae-364da2661108)

https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(af854a3a-2127-422b-91ae-364da2661108)

https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101(af854a3a-2127-422b-91ae-364da2661108)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(af854a3a-2127-422b-91ae-364da2661108)

https://www.kb.cert.org/vuls/id/927237(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.