CVE-2021-22937

Description

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.

From the Tenable Blog

CVE-2021-22937: Remote Code Execution Patch Bypass in Pulse Connect Secure

Published: 2021-08-05

Pulse Secure has patched CVE-2021-22937, a patch bypass for CVE-2020-8260, in its Connect Secure products.

References

https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective

https://www.tenable.com/blog/cve-2021-22937-remote-code-execution-patch-bypass-in-pulse-connect-secure

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3