Vulnerability Details : CVE-2019-11509
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.
Vulnerability category: Execute code
Products affected by CVE-2019-11509
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r1:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r2.1:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r2.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r3.2:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r7.1:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r9.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r4.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r5.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r6.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r7.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r3:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r4:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r10.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r11.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r2:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r1.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r3.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r8.0:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:r9.1:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r5:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r5.2:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r6:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r6.1:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:*:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4:r7:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-11509
0.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-11509
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
References for CVE-2019-11509
-
https://kb.pulsesecure.net/?atype=sa
Public KB - HomeVendor Advisory
-
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
Pulse Security Advisory: SA44101 - 2019-04: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RXVendor Advisory
-
https://www.kb.cert.org/vuls/id/927237
VU#927237 - Pulse Secure VPN contains multiple vulnerabilitiesThird Party Advisory;US Government Resource
Jump to