CVE-2019-11540 — Ivanti Connect Secure vulnerability

6 documents4 sources
Severity
9.8CRITICALNVD
EPSS
6.3%
top 9.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ivanti Connect SecurePulsesecure Pulse Connect SecurePulsesecure Pulse Policy Secure
Timeline
PublishedApr 26
Latest updateJun 18

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

2
GHSA
GHSA-rp2c-496x-gf5c: In Pulse Secure Pulse Connect Secure version 9↗2022-05-24
▶
CVEList
CVE-2019-11540: In Pulse Secure Pulse Connect Secure version 9↗2019-04-26
▶

💬Community

3
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)↗2024-06-18
▶
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████↗2021-07-29
▶
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███↗2019-12-02
▶
CVE-2019-11540 — Ivanti Connect Secure vulnerability | cvebase