CVE-2019-11539 | Vulnetix

CVE-2019-11539 PUBLISHED KEV CVSS 8 HIGH

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

EPSS 98.54% · 99.9th percentile

Risk Scores

CVSS 3.0

CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

EPSS Score

98.54%

99.9th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	*
pulsesecure	pulse_policy_secure	5.3r5.1, 5.1r1.0, 5.1r1.1
ivanti	connect_secure	8.1, 8.1, 8.1
ivanti	policy_secure	9.0, 9.0, 9.0

Timeline

CVE Published
Aug 10, 2019 PoC Published
Sep 4, 2019 VulnCheck XDB Entry
Sep 6, 2019 PoC Published
Oct 2, 2019 VulnCheck KEV Exploitation
Nov 12, 2019 PoC Published
Nov 13, 2019 PoC Published
Nov 20, 2019 PoC Published
Dec 2, 2019 PoC Published
May 7, 2020 PoC Published
Sep 15, 2020 VulnCheck KEV Exploitation
Sep 16, 2020 PoC Published

References

Open in Interactive Console →