Exploited vulnerability

CVE-2020-8218

TLP:CLEAR

Pulse Connect Secure Code Injection Vulnerability

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Facts

Vendor: Pulse Secure
Product: Pulse Connect Secure
CVSS: 7.2
EPSS (probability of exploitation within 30 days): 32.3 %
On CISA's Known Exploited Vulnerabilities list since: 7 March 2022
First known exploitation: 7 March 2022
CISA's deadline for US federal agencies: 7 September 2022
Weakness: CWE-94
First seen by Risk Letters: 7 March 2022

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD