« Volver al listado

CVE-2021-31922

Estado: ModificadaAlta (7.5)—

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pulsesecure — Virtual Traffic Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-31922",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-14T01:15:06.937",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de contrabando de solicitudes HTTP en Pulse Secure Virtual Traffic Manager antes de la versión 21.1 podría permitir a un atacante contrabandear una solicitud HTTP a través de un encabezado HTTP/2. Esta vulnerabilidad está resuelta en 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4 y 18.2R3"
    }
  ],
  "lastModified": "2026-06-17T03:52:29.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C530C115-90A1-4AE5-8B19-6033E1D01693",
              "versionEndIncluding": "18.1"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9573ABD-59C2-49AF-89FE-2121D265F401",
              "versionEndIncluding": "19.1",
              "versionStartIncluding": "18.3"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F22DCBAD-AD3A-478C-9928-0B47C6C00C18"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5812CCF7-FFD7-426A-B233-FDC7D07CC4F2"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14189C83-2981-43E7-A2B4-706CB3B8F9D9"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C3B5A62-B063-4BBD-8149-799B68AA97EE"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "052E6276-940A-4E93-92F3-E0B413F651CE"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "490F4C86-1C2B-40F1-BC6C-0ACB5BE1090D"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25554C36-2A34-4239-8B3D-BBA5BAD6C6F4"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9471FB6F-37E2-4FB5-BF49-2E47528C2F98"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29F94E21-E2BC-46BF-9B08-FCC4B404FC76"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}