CVE-2020-15352

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Score

CVSS 3.1 7.2 High

Status

Modified - cve@mitre.org

Published

2020-10-27

Last modified

2024-08-04

Weaknesses

CWE-611

Affected products

• Connect Secure (Ivanti)
• Policy Secure (Ivanti)
• Pulse Connect Secure (Pulsesecure)
• Pulse Policy Secure (Pulsesecure)

References

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601