CVE-2021-22893
KEV
🔴 Łataj teraz
Obejście uwierzytelnienia w Pulse Connect Secure umożliwia zdalne wykonanie kodu.
CVSS
10.0
EPSS
47.2%
Exploit
weaponized
Vendor
ivanti
Opis źródłowy (NVD)
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
auth-bypass rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 10.0 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 47.2% |
| Opublikowano (NVD) | 2021-04-23 17:15:08 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-12 05:17:37 UTC |
Referencje
- https://blog.pulsesecure.net/pulse-connect-secure-security-update/ (support@hackerone.com) [Vendor Advisory]
- https://kb.cert.org/vuls/id/213092 (support@hackerone.com) [Third Party Advisory, US Government Resource]
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ (support@hackerone.com) [Broken Link, Vendor Advisory]
- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html (support@hackerone.com) [Third Party Advisory]
- https://www.kb.cert.org/vuls/id/213092 (af854a3a-2127-422b-91ae-364da2661108) [US Government Resource]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]