CVE-2020-8206

Published: Jul 30, 2020Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.

Affected (24)

Products: Ivanti: Connect Secure, Policy Secure · Pulsesecure: Pulse Connect Secure, Pulse Policy Secure

2 products

2 products

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	Version 9.1
Ivanti Connect Secure	Version 9.1 r1
Ivanti Connect Secure	Version 9.1 r2
Ivanti Connect Secure	Version 9.1 r3
Ivanti Connect Secure	Version 9.1 r4.1
Ivanti Connect Secure	Version 9.1 r4.2
Ivanti Connect Secure	Version 9.1 r4.3
Ivanti Connect Secure	Version 9.1 r4
Ivanti Connect Secure	Version 9.1 r5
Ivanti Connect Secure	Version 9.1 r6
Ivanti Connect Secure	Version 9.1 r7
Pulsesecure Pulse Connect Secure	Up to 9.0

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Ivanti Policy Secure	Version 9.1
Ivanti Policy Secure	Version 9.1 r1
Ivanti Policy Secure	Version 9.1 r2
Ivanti Policy Secure	Version 9.1 r3.1
Ivanti Policy Secure	Version 9.1 r3
Ivanti Policy Secure	Version 9.1 r4.1
Ivanti Policy Secure	Version 9.1 r4.2
Ivanti Policy Secure	Version 9.1 r4
Ivanti Policy Secure	Version 9.1 r5
Ivanti Policy Secure	Version 9.1 r6
Ivanti Policy Secure	Version 9.1 r7
Pulsesecure Pulse Policy Secure	Up to 9.0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

Source: support@hackerone.com

Vendor Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.