CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2019-11539
High (7.2) in Ivanti Pulse Connect Secure and Pulse Policy Secure. In CISA KEV since 2021-11-03, with known ransomware use. EPSS 99% chance of exploitation in the next 30 days.
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
Severity
- EPSS
- 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)
- CISA KEV
- listed 2021-11-03, due 2022-05-03, known ransomware use
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ivanti:connect_secure
- ivanti:policy_secure
- pulsesecure:pulse_policy_secure
References
- http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html
- http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html
- http://www.securityfocus.com/bid/108073
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/