Description
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.
Metrics
CVSS 3.1 7.2/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://www.securityfocus.com/bid/108073Broken Link, Third Party Advisory, VDB Entry
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/Exploit, Third Party Advisory
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdfExploit, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101Vendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010Third Party Advisory
- https://www.kb.cert.org/vuls/id/927237Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/108073Broken Link, Third Party Advisory, VDB Entry
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/Exploit, Third Party Advisory
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdfExploit, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101Vendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010Third Party Advisory
- https://www.kb.cert.org/vuls/id/927237Third Party Advisory, US Government Resource
Timeline
- Published
- Apr 26, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified