CVE-2019-11540 | BDVDB-2026-115821 Detail
Description#
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
- http://www.securityfocus.com/bid/108073
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
- https://www.kb.cert.org/vuls/id/927237
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.