2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2020-8221" ,
"sourceIdentifier" : "support@hackerone.com" ,
"published" : "2020-07-30T13:15:12.063" ,
2024-01-16 21:00:29 +00:00
"lastModified" : "2024-01-16T19:18:25.610" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Analyzed" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface."
} ,
{
"lang" : "es" ,
"value" : "Se presenta una vulnerabilidad de salto de ruta en Pulse Connect Secure versiones anteriores a 9.1R8, que permite a un atacante autenticado leer archivos arbitrarios por medio de la interfaz web del administrador"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "HIGH" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.9 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 1.2 ,
"impactScore" : 3.6
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "SINGLE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.0
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.0 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-22"
}
]
} ,
{
"source" : "support@hackerone.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-22"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "9.0" ,
"matchCriteriaId" : "18272F7E-A9BA-4175-B6F6-F7E550D736CE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "8E84076A-C4AB-4C41-B325-F9557080E95A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r1:*:*:*:*:*:*" ,
"matchCriteriaId" : "1252710D-3A38-4C4D-8B97-1CEB6668A67B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r2:*:*:*:*:*:*" ,
"matchCriteriaId" : "C272B0B1-A08A-46D9-A8FB-5B2CF0C70A94"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r3:*:*:*:*:*:*" ,
"matchCriteriaId" : "002F211E-954E-4881-80B1-D92C77A3687D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4:*:*:*:*:*:*" ,
"matchCriteriaId" : "648BE1FA-7B29-416E-B827-25941170AB32"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.1:*:*:*:*:*:*" ,
"matchCriteriaId" : "DFE6AF6A-F6C4-4463-8316-5BAB9A13452F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.2:*:*:*:*:*:*" ,
"matchCriteriaId" : "79B29059-9C55-455F-8B96-525BCF4E1DFE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.3:*:*:*:*:*:*" ,
"matchCriteriaId" : "69567696-0EED-425F-B6E9-86DE4CF6F4A5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r5:*:*:*:*:*:*" ,
"matchCriteriaId" : "C17EC167-CA23-47DD-9403-9087376963E9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r6:*:*:*:*:*:*" ,
"matchCriteriaId" : "47BCB978-25F4-4B31-9806-B3458962DC91"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r7:*:*:*:*:*:*" ,
"matchCriteriaId" : "B4FB8381-79D4-42F4-910F-C574F8F0D322"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
2024-01-16 21:00:29 +00:00
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "6418A649-3A63-40CC-BD7C-309B3B0B2595"
} ,
2023-04-24 12:24:31 +02:00
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*" ,
"matchCriteriaId" : "A07B66E0-A679-4912-8CB1-CD134713EDC7"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*" ,
"matchCriteriaId" : "6D37A6E4-D58E-444D-AF6A-15461F38E81A"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*" ,
"matchCriteriaId" : "FC2B9DA0-E32B-4125-9986-F0D3814C66E9"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*" ,
"matchCriteriaId" : "38A0D7CF-7D55-4933-AE8C-36006D6779E1"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*" ,
"matchCriteriaId" : "C9A5BA3E-D6B3-453D-8DDF-FF16859FD0F8"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*" ,
"matchCriteriaId" : "BAFDA618-D15D-401D-AC68-0020259FEC57"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*" ,
"matchCriteriaId" : "D55AB5F0-132F-4C40-BF4F-684E139B774B"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*" ,
"matchCriteriaId" : "6BE937D2-8BEE-4E64-8738-F550EAD00F50"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*" ,
"matchCriteriaId" : "9C753520-1BC6-4980-AFC9-4C2FDDF2FD18"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*" ,
"matchCriteriaId" : "AC3863BC-3B9A-402B-A74A-149CDF717EC6"
2023-04-24 12:24:31 +02:00
} ,
{
"vulnerable" : true ,
2024-01-13 05:00:28 +00:00
"criteria" : "cpe:2.3:a:pulsesecure:pulse_policy_secure:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "9.0" ,
"matchCriteriaId" : "B031D2AE-70BE-48BB-A9E9-0A0DAAAFF55F"
2023-04-24 12:24:31 +02:00
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516" ,
"source" : "support@hackerone.com" ,
"tags" : [
"Vendor Advisory"
]
}
]
}
