A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
References
| Link | Resource |
|---|---|
| https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44800/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
27 Feb 2024, 21:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.4:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.3:*:*:*:*:*:* |
cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:* |
13 Jan 2024, 18:36
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.5:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.3:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r5.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r6.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:* |
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:* |
| First Time |
Ivanti connect Secure
Ivanti |
08 Jun 2021, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-120 | |
| References | (MISC) https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44800/ - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 8.8 |
| CPE | cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.4:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r4.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.5:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r6.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r5.0:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.3:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r2.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0rx:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r3.1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r10.2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.1:r11.3:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:9.0:r1:*:*:*:*:*:* |
27 May 2021, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-27 12:15
Updated : 2024-02-27 21:04
NVD link : CVE-2021-22908
Mitre link : CVE-2021-22908
CVE.ORG link : CVE-2021-22908
JSON object : View
Products Affected
ivanti
- connect_secure
pulsesecure
- pulse_connect_secure
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')