CVE-2020-12880
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD
Description
An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and can be retrieved. (The source code is otherwise inaccessible because the appliance has its hard disks encrypted, and no root shell is available during normal operation.)
Affected (23)
Products: Ivanti: Connect Secure, Policy Secure · Pulsesecure: Pulse Connect Secure, Pulse Policy Secure
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 9.1 | |
| Up to 9.0 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 9.1 r1 | |
| Up to 9.0 |
References (4)
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.