Actively exploited · Published Sep 29, 2020 · Assigned by hackerone
CVE-2020-8243
High 7.2 Exploited
In plain English
A high-severity code injection in Pulse Connect Secre. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 90.8% (higher than 99.8% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)90.8%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Pulse Connect Secre | Fixed in 9.1R8.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H