CVE-2020-8260 is a critical arbitrary code execution vulnerability affecting the Pulse Connect Secure admin web interface versions prior to 9.1R9, stemming from uncontrolled gzip extraction. With a CVSS score of 7.2 (HIGH) and a FAUCET Risk Score of 100/100, this vulnerability allows an authenticated attacker to achieve full compromise (confidentiality, integrity, availability) with low attack complexity. This CVE is actively exploited in the wild, has a Metasploit module available, and has garnered significant community attention and media coverage, indicating its high threat level.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.0CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.