pulse secure client auto connect connects to wrong location

These versions are not impacted for this CVE:ĬVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HĪ vulnerability in the Network File Share (NFS) of Pulse Connect Secure allows an authenticated end-user attacker to upload a malicious file to write arbitrary files to the local system. Unauthenticated remote attacker with network access via HTTPS can send a specially crafted URI to perform an arbitrary file reading vulnerability. Pulse Policy Secure 9.1R1 (9.) and above.Pulse Connect Secure 9.1R1 (9.) and above.The table below provides details of the vulnerabilities and the affected and not affected products: Refer to KB43892 – What releases will Pulse Secure apply fixes to resolve security vulnerabilities? per our End of Engineering (EOE) and End of Life (EOL) policies. We strongly recommend to upgrade to the corresponding version with the fix as soon as possible.CVE have been requested and will be updated in the future. Many of these vulnerabilities have a critical CVSS score and pose significant risk to your deployment.

This advisory also includes a remote code execution vulnerability that can allow an authenticated administrator to perform remote code execution on Pulse Connect Secure and Pulse Policy Secure gateways.

This includes an authentication by-pass vulnerability that can allow an unauthenticated user to perform a remote arbitrary file access on the Pulse Connect Secure gateway. Multiple vulnerabilities were discovered and have been resolved in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS).

Pulse secure client auto connect connects to wrong location