7.2
High
CVE-2020-8260 Ivanti Pulse Connect Secure Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-434
Description
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pulse Connect Secure / Pulse Policy Secure | 9.1R9 | No fix stated |
Other CVEs of Pulse Connect Secure / Pulse Policy Secure
The 5 CVEs of Pulse Connect Secure / Pulse Policy Secure →
CVE-2020-8263
A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct…
Not rated
CVE-2020-8262
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct…
Not rated
CVE-2020-8261
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection
Not rated
CVE-2020-8255
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform…
Not rated