CVE-2020-11582 — Improper Restriction of Excessive Authentication Attempts in Pulse Connect Secure

CWE-307 — Improper Restriction of Excessive Authentication AttemptsCWE-668 — Resource Exposure3 documents3 sources
Severity
8.8HIGHNVD
CNA8.1
EPSS
0.1%
top 66.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Pulsesecure Pulse Connect Secure
Timeline
PublishedApr 6
Latest updateMay 24

Description

An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-7mjm-6675-w446: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06↗2022-05-24
▶
CVEList
CVE-2020-11582: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06↗2020-04-06
▶
CVE-2020-11582 — Pulse Connect Secure vulnerability | cvebase