Actively exploited · Published May 27, 2021 · Assigned by hackerone
CVE-2021-22900
High 7.2 Exploited
In plain English
A high-severity code injection in Pulse Secure Secure. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 14.1% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Pulse Secure Secure | Fixed in 9.1R11.4 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H