Vulnerability · Published Jul 27, 2020 · Assigned by mitre

CVE-2020-12880

Medium 5.5

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and can be retrieved. (The source code is otherwise inaccessible because the appliance has its hard disks encrypted, and no root shell is available during normal operation.)

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://kb.pulsesecure.net/?atype=sa x_refsource_MISC
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 x_refsource_CONFIRM