Actively exploited · Published Oct 28, 2020 · Assigned by hackerone
CVE-2020-8260
High 7.2 Exploited
In plain English
A high-severity unrestricted file upload in Pulse Connect Secure / Pulse Policy Secure. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 96.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Pulse Connect Secure / Pulse Policy Secure | 9.1R9 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H