Vulnerability Details : CVE-2020-13162
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Products affected by CVE-2020-13162
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.1:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r2.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r3.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.1:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.2:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.2:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r6.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r7.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r1.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2.1:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3.2:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r5.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r6.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r1.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r2.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r3.1:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.1:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r4.2:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r5.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r6.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.1:r7.0:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_installer_service:8.3:*:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_installer_service:9.1:*:*:*:*:windows:*:*
- cpe:2.3:a:pulsesecure:pulse_secure_installer_service:9.1:r5.0:*:*:*:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-13162
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-13162
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST | |
|
7.0
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST |
CWE ids for CVE-2020-13162
-
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-13162
-
https://kb.pulsesecure.net/?atype=sa
Public KB - HomeVendor Advisory
-
http://packetstormsecurity.com/files/159065/Pulse-Secure-Windows-Client-Privilege-Escalation.html
Pulse Secure Windows Client Privilege Escalation ≈ Packet StormThird Party Advisory;VDB Entry
-
http://seclists.org/fulldisclosure/2020/Sep/15
Full Disclosure: Pulse Secure Windows Client <9.1.6 (CVE-2020-13162) - exploitMailing List;Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/Jun/25
Full Disclosure: Pulse Secure Client < 9.1R6 TOCTOU Privilege Escalation (CVE-2020-13162)Mailing List;Third Party Advisory
-
https://twitter.com/gsepcali/status/1262551597990711296
sepcali on Twitter: "I will share the technical details and a working exploit on https://t.co/oNr2ig1iNs when a patch from the vendor will be available. :) @redtimmysec" / TwitterThird Party Advisory
-
https://twitter.com/gsepcali/status/1272927080909623297
gsepcali on Twitter: "CVE-2020-13162 is a privilege escalation bug affecting every version of #PulseSecure Client for Windows <9.1R6. I have reported this vulnerability in April. It is now fixed anThird Party Advisory
-
https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/
Pulse Secure Client for Windows <9.1.6 TOCTOU Privilege Escalation (CVE-2020-13162) - Red Timmy SecurityExploit;Third Party Advisory
-
http://packetstormsecurity.com/files/158117/Pulse-Secure-Client-For-Windows-Local-Privilege-Escalation.html
Pulse Secure Client For Windows Local Privilege Escalation ≈ Packet StormThird Party Advisory;VDB Entry
-
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44503
Pulse Security Advisory: SA44503 - 2020-06: Out-of-Cycle Advisory: Pulse Secure Client TOCTOU Privilege Escalation Vulnerability (CVE-2020-13162)Vendor Advisory
-
https://twitter.com/sepcali/status/1262551597990711296
sepcali on Twitter: "I will share the technical details and a working exploit on https://t.co/oNr2ig1iNs when a patch from the vendor will be available. :) @redtimmysec" / TwitterThird Party Advisory
Jump to