{ "id": "CVE-2020-15352", "sourceIdentifier": "cve@mitre.org", "published": "2020-10-27T05:15:12.787", "lastModified": "2020-11-02T16:35:38.253", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request." }, { "lang": "es", "value": "Una vulnerabilidad de tipo XML external entity (XXE) en Pulse Connect Secure (PCS) versiones anteriores a 9.1R9 y Pulse Policy Secure (PPS) versiones anteriores a 9.1R9, permite a administradores autenticados remotos conducir ataques de tipo server-side request forgery (SSRF) por medio de un DTD dise\u00f1ado en una petici\u00f3n XML" } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH" }, "exploitabilityScore": 1.2, "impactScore": 5.9 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.5 }, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-611" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0", "matchCriteriaId": "18272F7E-A9BA-4175-B6F6-F7E550D736CE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:-:*:*:*:*:*:*", "matchCriteriaId": "8E84076A-C4AB-4C41-B325-F9557080E95A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r1:*:*:*:*:*:*", "matchCriteriaId": "1252710D-3A38-4C4D-8B97-1CEB6668A67B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r2:*:*:*:*:*:*", "matchCriteriaId": "C272B0B1-A08A-46D9-A8FB-5B2CF0C70A94" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r3:*:*:*:*:*:*", "matchCriteriaId": "002F211E-954E-4881-80B1-D92C77A3687D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4:*:*:*:*:*:*", "matchCriteriaId": "648BE1FA-7B29-416E-B827-25941170AB32" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.1:*:*:*:*:*:*", "matchCriteriaId": "DFE6AF6A-F6C4-4463-8316-5BAB9A13452F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.2:*:*:*:*:*:*", "matchCriteriaId": "79B29059-9C55-455F-8B96-525BCF4E1DFE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r4.3:*:*:*:*:*:*", "matchCriteriaId": "69567696-0EED-425F-B6E9-86DE4CF6F4A5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r5:*:*:*:*:*:*", "matchCriteriaId": "C17EC167-CA23-47DD-9403-9087376963E9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r6:*:*:*:*:*:*", "matchCriteriaId": "47BCB978-25F4-4B31-9806-B3458962DC91" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r7:*:*:*:*:*:*", "matchCriteriaId": "B4FB8381-79D4-42F4-910F-C574F8F0D322" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8:*:*:*:*:*:*", "matchCriteriaId": "96E3A807-BCFB-4A19-90D3-BDB3A5A36161" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8.1:*:*:*:*:*:*", "matchCriteriaId": "A8762030-CFCE-4524-9DB1-8C4796C1A885" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r8.2:*:*:*:*:*:*", "matchCriteriaId": "333A0F57-87A7-459D-8CA3-2CBED3219B78" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0", "matchCriteriaId": "B031D2AE-70BE-48BB-A9E9-0A0DAAAFF55F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r1:*:*:*:*:*:*", "matchCriteriaId": "1A99A84F-1E38-4B2E-B482-41E975D2B992" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r2:*:*:*:*:*:*", "matchCriteriaId": "6A1B7EB7-57CA-4578-8F95-6FE90C41C70A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r3:*:*:*:*:*:*", "matchCriteriaId": "3CA870E8-C3B6-49AC-8905-B747B97E17B2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r3.1:*:*:*:*:*:*", "matchCriteriaId": "F620CA05-5DD2-4307-AA90-479BA9859A60" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r4:*:*:*:*:*:*", "matchCriteriaId": "4C37ACCA-84F7-4D20-9695-2B028791967A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r4.1:*:*:*:*:*:*", "matchCriteriaId": "38A0D053-0AE0-410C-82F1-577C1E8E3913" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r4.2:*:*:*:*:*:*", "matchCriteriaId": "2C415B9E-F65C-4189-8AA6-DE39A0DE33F4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r5:*:*:*:*:*:*", "matchCriteriaId": "2D91B4D9-54B5-4D5D-BC11-D5A9E2A8E518" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r6:*:*:*:*:*:*", "matchCriteriaId": "C768F191-8685-4723-B0B4-5D6DA97318DD" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r7:*:*:*:*:*:*", "matchCriteriaId": "CF6EB502-E2B1-4D8B-ACE7-6C998D29DBE8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:pulsesecure:pulse_policy_secure:9.1:r8:*:*:*:*:*:*", "matchCriteriaId": "1EE141EA-2EF9-4229-B618-59853628743A" } ] } ] } ], "references": [ { "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] } ] }