CVE-2019-11508

I

n Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ivanti:connect_secure:7.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r1.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r12.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r13.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r14.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r15.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r16.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r17.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r18.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r19.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r19.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r2.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r20.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r20.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r20.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r21.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r22.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r22.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r22.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r22.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r22.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r3.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r4.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r7.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r8.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.1:r9.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r1.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r11.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r11.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r12.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r13.6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r2.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r3.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r4.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r7.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r8.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r9.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r9.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r9.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:7.4:r9.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_connect_secure:7.4:*:*:*:*:*:*:*

History

21 Nov 2024, 04:21

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/108073 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/108073 - Broken Link, Third Party Advisory, VDB Entry
References () https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - Exploit, Third Party Advisory () https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - Exploit, Third Party Advisory
References () https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - Exploit, Third Party Advisory () https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - Exploit, Third Party Advisory
References () https://kb.pulsesecure.net/?atype=sa - Third Party Advisory, Vendor Advisory () https://kb.pulsesecure.net/?atype=sa - Third Party Advisory, Vendor Advisory
References () https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - Patch, Vendor Advisory () https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - Patch, Vendor Advisory
References () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 - Third Party Advisory () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 - Third Party Advisory
References () https://www.kb.cert.org/vuls/id/927237 - Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/927237 - Third Party Advisory, US Government Resource

Information

Published : 2019-05-08 17:29

Updated : 2024-11-21 04:21


NVD link : CVE-2019-11508

Mitre link : CVE-2019-11508

CVE.ORG link : CVE-2019-11508


JSON object : View

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')