Critical Β· published April 23, 2021
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 98.8th percentile for exploit probability.
π¨ An unauthenticated attacker can execute code remotely on your Pulse Connect Secure gateway! This authentication bypass vulnerability could open the door wide for chaos. π₯ Think of this like a hotel with a stunning lobby but no front desk personnel to check in guests. Anyone can waltz in and make themselves at home, potentially accessing sensitive areas that they shouldnβt be in. If exploited, this vulnerability could allow an attacker to take control of your system, leading to data breaches, unauthorized access, and even full remote code execution. The ramifications could be absolutely devastating for your organization's security and integrity, as they could manipulate or steal sensitive information.
Think of this like a hotel with a stunning lobby but no front desk personnel to check in guests. Anyone can waltz in and make themselves at home, potentially accessing sensitive areas that they shouldnβt be in. CVE-2021-22893 arises from a failure to properly authenticate users through the Windows File Share Browser and Pulse Secure Collaboration features, leaving the door open for attackers to execute arbitrary code on the Pulse Connect Secure gateway.
If exploited, this vulnerability could allow an attacker to take control of your system, leading to data breaches, unauthorized access, and even full remote code execution. The ramifications could be absolutely devastating for your organization's security and integrity, as they could manipulate or steal sensitive information. Immediate action is crucial: update your Pulse Connect Secure to version 9.1R2 or later to close this vulnerability. Additionally, conduct a thorough review of your security configurations and access controls to ensure no unauthorized access has occurred. π You've got this! With these actions, you can tighten up your defenses and protect your network from any unwelcome guests. π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |