Detections
Analytics
Pulse Connect Secure Multiple Vulnerabilities (SA44101)
critical Nessus Plugin ID 124766
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
According to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities.- An arbitrary file read vulnerability exists in PCS. An unauthenticated, remote attacker can exploit this, via specially crafted URI, to read arbitrary files and disclose sensitive information. (CVE-2019-11510)
- Multiple vulnerabilities are found in Ghostscript.(CVE-2018-16513 , CVE-2018-18284, CVE-2018-15911, CVE-2018-15910, CVE-2018-15909)
- A session hijacking vulnerability exists in PCS. An unauthenticated, remote attacker can exploit this, to perform actions in the user or administrator interface with the privileges of another user. (CVE-2019-11540)
- An authentication leaks seen in users using SAML authentication with the reuse existing NC (Pulse) session option.
(CVE-2019-11541)
- Multiple vulnerabilities found in the admin web interface of PCS.
(CVE-2019-11543, CVE-2019-11542, CVE-2019-11509, CVE-2019-11539)
- Multiple vulnerabilities found in Network File Share (NFS) of PCS , allows the attacker to read/write arbitrary files on the affected device. (CVE-2019-11538, CVE-2019-11508)
- A cross-site scripting (XSS) vulnerability exists in application launcher page due to improper validation of user-supplied input before returning it to users. An attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.
(CVE-2019-11507)
Refer to the vendor advisory for additional information.
Solution
Upgrade to the appropriate version referenced in the advisory.See Also
Plugin Details
Severity: Critical
ID: 124766
File Name: pulse_connect_secure-sa-44101.nasl
Version: 1.22
Type: remote
Family: Misc.
Published: 5/10/2019
Updated: 4/25/2023
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-11540
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
CVSS Score Source: CVE-2019-11510
Vulnerability Information
CPE: cpe:/a:pulsesecure:pulse_connect_secure
Required KB Items: installed_sw/Pulse Connect Secure
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/9/2019
Vulnerability Publication Date: 5/9/2019
CISA Known Exploited Vulnerability Due Dates: 4/23/2021, 5/3/2022
Exploitable With
Metasploit (Pulse Secure VPN Arbitrary Command Execution)
Elliot (Pulse Connect Secure File Disclosure)
Reference Information
CVE: CVE-2018-15909, CVE-2018-15910, CVE-2018-15911, CVE-2018-16513, CVE-2018-18284, CVE-2019-11507, CVE-2019-11508, CVE-2019-11509, CVE-2019-11510, CVE-2019-11538, CVE-2019-11539, CVE-2019-11540, CVE-2019-11541, CVE-2019-11542, CVE-2019-11543
CISA-NCAS: AA22-011A
IAVA: 0001-A-0001-S, 2019-A-0309-S