CVE-2018-20307

Published: Dec 20, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation.

Affected (4)

Products: Pulsesecure: Virtual Traffic Manager

Pulsesecure

1 product

Virtual Traffic Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Pulsesecure Virtual Traffic Manager	Version 10.4
Pulsesecure Virtual Traffic Manager	Version 17.2
Pulsesecure Virtual Traffic Manager	Version 9.9
Pulsesecure Virtual Traffic Manager	Version 9.9 r1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

Source: cve@mitre.org

Vendor Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.