CVE-2019-11542

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy…

High · published April 26, 2019

Patch now

High probability of exploitation

CVSS calls it high at 8.0. It sits in the 99.3th percentile for exploit probability.

CVSS v3.0
8.0
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.65590 · 99.3th percentile
Published
2019-04-26T01:40Z
EPSS history
Timeline
  • 26 APR 01:40Z
    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy…
    cvelistv5