« Volver al listado

CVE-2020-8254

Estado: ModificadaAlta (8.8)—

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pulsesecure — Pulse Secure Desktop Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8254",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Pulse Secure Desktop Client",
          "versions": [
            {
              "status": "affected",
              "version": "9.1R9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-28T13:15:12.747",
  "references": [
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Pulse Secure Desktop Client versiones anteriores a 9.1R9, presenta una Ejecución de Código Remota (RCE) si usuarios pueden ser convencidos a conectarse a un servidor malicioso.&#xa0;Esta vulnerabilidad solo afecta a Windows PDC. Para mejorar la seguridad de las conexiones entre los clientes Pulse y Pulse Connect Secure, véase la(s) siguiente(s) recomendación(es): Deshabilite el certificado confiable dinámico para PDC"
    }
  ],
  "lastModified": "2026-06-17T03:26:08.430",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3BBCA2A-A964-4B88-84D2-09199D7830D2",
              "versionEndExcluding": "9.1"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r1:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D8D50A3-4BCA-424C-80A6-FB748505E322"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r2:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4582A0E1-A8CE-41F1-B66B-093B6A6B0C5E"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E752E4C2-30CB-46D1-A785-49EDF2A15248"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.1:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75017203-FA52-4C5D-9B9C-E38F26852BB2"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6460E3E-758A-41AC-A1A3-7288B5030C0F"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.1:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D16AD2E8-9C7D-4EA2-8AF1-881546E97D75"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.2:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFB49374-0F24-41BA-BC44-51DC22D27B0B"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r5:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3996F908-D6EE-461B-8A2B-BF2FD94BB776"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r6:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F51DF92D-EEEC-4F2D-902C-6084201CAF05"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A502DBE4-F14E-4115-8AFE-12D47AEAFEF4"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7.1:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC134B99-2DDE-43F1-9808-A4AC4FDD943E"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r8:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A34AEAC3-082E-4EA3-B46B-782F11053F15"
            },
            {
              "criteria": "cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r8.2:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32465036-9876-4AAD-86A0-C5503C0C55F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}