« Volver al listado

CVE-2018-20307

Estado: ModificadaMedia (4.3)—

Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pulsesecure — Virtual Traffic Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-20307",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-20T09:29:00.477",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation."
    },
    {
      "lang": "es",
      "value": "Pulse Secure Virtual Traffic Manager, en versiones 9.9 anteriores a la 9.9r2 y la 10.4r1 permiten que un usuario autenticado remoto obtenga información sensible del historial de actividades aprovechando la validación incorrecta de permisos."
    }
  ],
  "lastModified": "2026-06-17T01:52:35.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:9.9:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0771AE6-E666-4D75-A7C0-4E0160766866"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:9.9:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "574B1892-E911-43B8-B982-884B927DE275"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:10.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4E946E0-F656-46AB-94B7-202133AEB55A"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:17.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CFD0114-C9E8-4236-9939-4F2FF4EE83B8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}