CVE-2019-11542 — Out-of-bounds Write in Ivanti Connect Secure

CWE-787 — Out-of-bounds Write6 documents4 sources
Severity
7.2HIGHNVD
EPSS
34.7%
top 2.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ivanti Connect SecurePulsesecure Pulse Connect SecurePulsesecure Pulse Policy Secure
Timeline
PublishedApr 26
Latest updateJun 18

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages3 packages

▶NVDivanti/connect_secure8.1, 8.2, 8.3+2

🔴Vulnerability Details

2
GHSA
GHSA-2g59-pjjw-j55p: In Pulse Secure Pulse Connect Secure version 9↗2022-05-24
▶
CVEList
CVE-2019-11542: In Pulse Secure Pulse Connect Secure version 9↗2019-04-26
▶

💬Community

3
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)↗2024-06-18
▶
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████↗2021-07-29
▶
HackerOne
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███↗2019-12-02
▶
CVE-2019-11542 — Out-of-bounds Write in Ivanti | cvebase