CVE-2020-15408 — Missing Authorization in Pulse Connect Secure

CWE-862 — Missing Authorization3 documents3 sources
Severity
4.6MEDIUMNVD
CNA3.7
EPSS
0.2%
top 54.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Pulsesecure Pulse Connect SecurePulsesecure Pulse Secure Desktop Client
Timeline
PublishedJul 28
Latest updateMay 24

Description

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 2.1 | Impact: 2.5

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-x3p9-c74w-j5mx: An issue was discovered in Pulse Secure Pulse Connect Secure before 9↗2022-05-24
▶
CVEList
CVE-2020-15408: An issue was discovered in Pulse Secure Pulse Connect Secure before 9↗2020-07-28
▶
CVE-2020-15408 — Missing Authorization | cvebase