« Volver al listado

CVE-2020-8256

Estado: ModificadaMedia (4.9)—

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Ivanti — Connect SecurePulsesecure — Pulse Connect Secure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8256",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-8256",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-18T16:03:20.337535Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Pulse Connect Secure",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 9.1R8.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-30T18:15:29.287",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración web de Pulse Connect Secure versiones anteriores a 9.1R8.2, podría permitir a un atacante autenticado obtener acceso arbitrario de lectura de archivos por medio de Pulse Collaboration mediante una vulnerabilidad de tipo XML External Entity (XXE)"
    }
  ],
  "lastModified": "2026-06-17T03:26:08.640",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F450898-0B06-4073-9B76-BF22F68BD14F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B21C181-DC49-4EBD-9932-DBB337151FF7"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FEFC4B1-7350-46F9-80C1-42F5AE06142F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB7A6D62-6576-4713-9BF4-11068A72E8B7"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843BC1B9-50CC-4F8F-A454-A0CEC6E92290"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5355372-03EA-46D7-9104-A2785C29B664"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DE32A0C-8944-4F51-A286-266055CA4B2F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0349A0CC-A372-4E51-899E-D7BA67876F4B"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93D1A098-BD77-4A7B-9070-A764FB435981"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CCC2D7B-F835-45EC-A316-2F0C5F2CF565"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD812596-C77C-4129-982F-C22A25B52126"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FA0B20D-3FA1-42AE-BDC5-93D8A182927C"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFFA0B02-7F6D-4434-B1E7-EB8520FD68A0"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18272F7E-A9BA-4175-B6F6-F7E550D736CE",
              "versionEndIncluding": "9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}