10.0
Critique
Exploitée
· rançongiciel
CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-287
Description
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Pulse Connect Secure | Versions non publiées |
Références
- kb.pulsesecure.net kb.pulsesecure.net
- blog.pulsesecure.net blog.pulsesecure.net
- www.fireeye.com www.fireeye.com
- kb.cert.org kb.cert.org
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Pulse Connect Secure
Les 21 CVE de Pulse Connect Secure →
CVE-2021-22965
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a…
Non notée
CVE-2021-22937
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write…
Non notée
CVE-2021-22936
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack…
Non notée
CVE-2021-22935
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command…
Non notée