CVE-2020-8254 — Relative Path Traversal in Pulse Secure Desktop Client

CWE-23 — Relative Path TraversalCWE-22 — Path Traversal3 documents3 sources
Severity
8.8HIGHNVD
EPSS
2.4%
top 14.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Pulsesecure Pulse Secure Desktop Client
Timeline
PublishedOct 28
Latest updateMay 24

Description

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-p993-j26m-6v98: A vulnerability in the Pulse Secure Desktop Client < 9↗2022-05-24
▶
CVEList
CVE-2020-8254: A vulnerability in the Pulse Secure Desktop Client < 9↗2020-10-28
▶
CVE-2020-8254 — Relative Path Traversal | cvebase