جزئیات آسیب‌پذیری

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 x_refsource_CONFIRM
• http://www.securityfocus.com/bid/108073 vdb-entryx_refsource_BID
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 x_refsource_CONFIRM
• https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf x_refsource_MISC
• http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html x_refsource_MISC
• https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ x_refsource_MISC
• https://www.kb.cert.org/vuls/id/927237 third-party-advisoryx_refsource_CERT-VN
• http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html x_refsource_MISC
• http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html x_refsource_MISC
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539 government-resource