EXPOSURES › CVE-2020-8243

CVE-2020-8243

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2021-11-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-8243 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 65/100 rceexploited-in-wildunpatched

An authenticated attacker could upload a custom template to Pulse Connect Secure to perform code execution.

Ivanti Pulse Connect Secure's admin web interface allowed authenticated attackers to upload custom templates for code execution. DIB orgs must ensure this unpatched vulnerability is mitigated, as it could lead to system compromise and data breaches. Organizations should verify their Pulse Connect Secure versions are patched and restrict admin access.

Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed code execution, indicating a significant security oversight despite being authenticated-only.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Ivanti · vendor Pulse Connect Secure · product

DESCRIPTION

Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.

SENTIMENT · TRUSTED SOURCES

synthesis severe-fallout -0.60

Vulnerability in admin interface allowing code execution via template upload is a severe flaw, though no specific press condemnation or authority fallout is detailed in the provided sources.

cooey ↗ severe-fallout -0.60

Severe vulnerability in admin interface allowing code execution via template upload.

"Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution."

www.itechguides.com ↗ severe-fallout +0.00

No specific sentiment toward Ivanti regarding CVE-2020-8243; source text is largely unrelated promotional content.

sam.gov ↗ severe-fallout +0.00