CVE-2019-11510

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada ivanti connect secure. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

Rincian

Terbit di NVD

8 Mei 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 100,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kb.pulsesecure.net/?atype=sa not applicable · advisory vendor
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ broken link · patch · advisory vendor
• https://www.kb.cert.org/vuls/id/927237 advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11510 pemerintah AS
• http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosur... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/108073 broken link · advisory pihak ketiga · vdb entry
• https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ broken link · advisory pihak ketiga
• https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitt... exploit · advisory pihak ketiga
• https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf advisory pihak ketiga
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 advisory pihak ketiga
• https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacam... mailing list