Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-11541

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC (Pulse) Session option may see authentication leaks.

Published

2019-04-26T02:29:00.423

Last Modified

2024-11-21T04:21:18.350

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ivanti	connect_secure	8.2	Yes
Application	ivanti	connect_secure	8.3	Yes
Application	pulsesecure	pulse_connect_secure	8.2r1.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r1.1	Yes
Application	pulsesecure	pulse_connect_secure	8.2r2.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r3.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r3.1	Yes
Application	pulsesecure	pulse_connect_secure	8.2r4.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r4.1	Yes
Application	pulsesecure	pulse_connect_secure	8.2r5.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r5.1	Yes
Application	pulsesecure	pulse_connect_secure	8.2r6.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r7.0	Yes
Application	pulsesecure	pulse_connect_secure	8.2r7.1	Yes
Application	pulsesecure	pulse_connect_secure	8.2rx	Yes
Application	pulsesecure	pulse_connect_secure	8.3rx	Yes
Application	pulsesecure	pulse_connect_secure	9.0r1	Yes
Application	pulsesecure	pulse_connect_secure	9.0r2	Yes
Application	pulsesecure	pulse_connect_secure	9.0r2.1	Yes
Application	pulsesecure	pulse_connect_secure	9.0r3	Yes
Application	pulsesecure	pulse_connect_secure	9.0r3.1	Yes
Application	pulsesecure	pulse_connect_secure	9.0r3.2	Yes
Application	pulsesecure	pulse_connect_secure	9.0rx	Yes

References

http://www.securityfocus.com/bid/108073 Third Party Advisory, VDB Entry ([email protected])
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 Vendor Advisory ([email protected])
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Vendor Advisory ([email protected])
https://www.kb.cert.org/vuls/id/927237 Third Party Advisory, US Government Resource ([email protected])
http://www.securityfocus.com/bid/108073 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.kb.cert.org/vuls/id/927237 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)